- CVE-2026-52858: code execution via crafted Python module in omni-completion: exec() ran from/import statements in attacker-controlled buffers; fixed by disabling exec of import/from (runtime/autoload/python3complete.vim, pythoncomplete.vim, upstream patch 9.2.0561) - CVE-2026-52859: out-of-bounds read in update_snapshot() when a terminal cell fills all six VTERM_MAX_CHARS_PER_CELL combining-character slots; the unterminated cell.chars[] loop walked past the array and appended OOB values into the scrollback buffer (src/terminal.c, upstream patch 9.2.0565) - CVE-2026-52860: code execution via crafted Python def/class headers in omni-completion: parameter default-values, annotations, and base-class expressions were passed to exec() and evaluated; fixed by stripping defaults/annotations and whitelisting base-class expressions to dotted names (runtime/autoload/python3complete.vim, pythoncomplete.vim, upstream patch 9.2.0597)