CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 6:23 PM ET)

What this means for you

This week: 3,227 CVEs published, 238 critical, and 5 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,227; Show in the list
Critical, last 7 days: 238; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product vim:vim. Show all products

87 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2021-3928	High 7.3	Use of Uninitialized Variable in vim/vim Assigned by @huntrdev	Nov 4, 2021
CVE-2021-3927	High 7.3	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Nov 4, 2021
CVE-2021-3974	High 7.3	Use After Free in vim/vim Assigned by @huntrdev	Nov 18, 2021
CVE-2021-3973	High 7.3	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Nov 19, 2021
CVE-2021-3968	High 8.0	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Nov 19, 2021
CVE-2021-4136	High 7.3	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Dec 19, 2021
CVE-2021-4166	High 7.1	Out-of-bounds Read in vim/vim Assigned by @huntrdev	Dec 25, 2021
CVE-2022-0213	Medium 6.8	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Jan 13, 2022
CVE-2022-0351	High 8.4	Access of Memory Location Before Start of Buffer in vim/vim Assigned by @huntrdev	Jan 24, 2022
CVE-2022-1616	High 7.3	Use after free in append_command in vim/vim Assigned by @huntrdev	May 6, 2022

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.