* SECURITY UPDATE: with latin1 encoding CTRL-W might go before the start of the command line - debian/patches/CVE-2022-1619.patch: with latin1 encoding CTRL-W might go before the start of the command line - CVE-2022-1619 * SECURITY UPDATE: using an invalid index when looking for spell suggestions - debian/patches/CVE-2022-2126.patch: using an invalid index when looking for spell suggestions - CVE-2022-2126 * SECURITY UPDATE: reading beyond the end of the line with lisp indenting - debian/patches/CVE-2022-2183.patch: reading beyond the end of the line with lisp indenting - CVE-2022-2183 * SECURITY UPDATE: reading past the end of a string with some completions - debian/patches/CVE-2022-2286.patch: reading past the end of a string with some completions - CVE-2022-2286 * SECURITY UPDATE: reading past the end of a completion with a long line and 'infercase' set - debian/patches/CVE-2022-2343.patch: reading past the end of a completion with a long line and 'infercase' set - CVE-2022-2343 * SECURITY UPDATE: illegal memory access when a pattern starts with an illegal byte - debian/patches/CVE-2022-2581.patch: illegal memory access when a pattern starts with an illegal byte - CVE-2022-2581 * SECURITY UPDATE: using freed memory with an error in an assert argument - debian/patches/CVE-2022-2817.patch: using freed memory with an error in an assert argument - CVE-2022-2817 * SECURITY UPDATE: using freed memory when an autocommand changes a mark - debian/patches/CVE-2022-3256.patch: using freed memory when an autocommand changes a mark - CVE-2022-3256 * SECURITY UPDATE: buffer underflow with an unexpected :finally - debian/patches/CVE-2022-3296.patch: buffer underflow with an unexpected :finally - CVE-2022-3296 * SECURITY UPDATE: missing NULL check on the return value of XChangeGC() - debian/patches/CVE-2022-47024.patch: missing NULL check on the return value of XChangeGC() - CVE-2022-47024 * SECURITY UPDATE: invalid memory access with a bad 'statusline' value - debian/patches/CVE-2023-0049.patch: invalid memory access with a bad 'statusline' value - CVE-2023-0049 * SECURITY UPDATE: buffer overflow in netbeans special_keys() handling - debian/patches/CVE-2026-26269.patch: buffer overflow in netbeans special_keys() handling - CVE-2026-26269 * SECURITY UPDATE: insufficient validation of hostname and port in netrw URIs allows command injection - debian/patches/CVE-2026-28417.patch: insufficient validation of hostname and port in netrw URIs allows command injection - CVE-2026-28417 * SECURITY UPDATE: netbeans defineAnnoType and specialKeys pass unvalidated names into Ex commands, allowing command injection - debian/patches/CVE-2026-39881.patch: netbeans defineAnnoType and specialKeys pass unvalidated names into Ex commands, allowing command injection - CVE-2026-39881 * SECURITY UPDATE: command injection via backticks in tag files - debian/patches/CVE-2026-41411.patch: command injection via backticks in tag files - CVE-2026-41411 * SECURITY UPDATE: possible code execution with python3complete and pythoncomplete - debian/patches/CVE-2026-52858.patch: possible code execution with python3complete and pythoncomplete - CVE-2026-52858 * SECURITY UPDATE: out-of-bounds read in update_snapshot() with a full combining-character cell - debian/patches/CVE-2026-52859.patch: out-of-bounds read in update_snapshot() with a full combining-character cell - CVE-2026-52859 * SECURITY UPDATE: out-of-bounds write with soundfold() - debian/patches/CVE-2026-57455.patch: out-of-bounds write with soundfold() - CVE-2026-57455 * SECURITY UPDATE: code execution via a crafted .VimballRecord file - debian/patches/CVE-2026-73076.patch: code execution via a crafted .VimballRecord file - CVE-2026-73076