BI
Vendor
Bitdefender
149
CVEs
0
On KEV
0
New 30D
Products
TS9.8
Total Security
Bitdefender
21 CVEs0 on KEV0 new
GR10.0
Gravityzone
Bitdefender
16 CVEs0 on KEV0 new
ES10.0
Endpoint Security Tools
Bitdefender
13 CVEs0 on KEV0 new
IS9.8
Internet Security
Bitdefender
12 CVEs0 on KEV0 new
AP7.8
Antivirus Plus
Bitdefender
10 CVEs0 on KEV0 new
AN9.8
Antivirus
Bitdefender
8 CVEs0 on KEV0 new
BI–
Bitdefender
Bitdefender
8 CVEs0 on KEV0 new
EN7.5
Engines
Bitdefender
6 CVEs0 on KEV0 new
BF8.8
Box Firmware
Bitdefender
5 CVEs0 on KEV0 new
ES9.8
Endpoint Security
Bitdefender
5 CVEs0 on KEV0 new
A27.8
Antivirus 2020
Bitdefender
4 CVEs0 on KEV0 new
IS8.8
Internet Security 2018
Bitdefender
4 CVEs0 on KEV0 new
SA8.8
Safepay
Bitdefender
4 CVEs0 on KEV0 new
B29.8
Box 2 Firmware
Bitdefender
3 CVEs0 on KEV0 new
HI7.0
Hypervisor Introspection
Bitdefender
3 CVEs0 on KEV0 new
SE5.3
Scan Engines
Bitdefender
3 CVEs0 on KEV0 new
TS8.8
Total Security 2020
Bitdefender
3 CVEs0 on KEV0 new
US9.1
Update Server
Bitdefender
3 CVEs0 on KEV0 new
GC9.8
Gravityzone Control Center
Bitdefender
2 CVEs0 on KEV0 new
NA7.8
Napoca
Bitdefender
2 CVEs0 on KEV0 new
NB7.8
Napoca bare-metal hypervisor
Bitdefender
2 CVEs0 on KEV0 new
AS5.3
Antimalware Software Development Kit
Bitdefender
1 CVEs0 on KEV0 new
BA–
Bitdefender Antivirus
Bitdefender
1 CVEs0 on KEV0 new
BC–
Bitdefender Client
Bitdefender
1 CVEs0 on KEV0 new
BT–
Bitdefender Total Security 2010
Bitdefender
1 CVEs0 on KEV0 new
CE9.8
Central
Bitdefender
1 CVEs0 on KEV0 new
ES6.7
Endpoint Security Tool
Bitdefender
1 CVEs0 on KEV0 new
GB7.8
Gravityzone Business Security
Bitdefender
1 CVEs0 on KEV0 new
GU5.3
Gravityzone Update Server
Bitdefender
1 CVEs0 on KEV0 new
OA–
Online Anti-virus Scanner
Bitdefender
1 CVEs0 on KEV0 new
SE6.1
Securepass
Bitdefender
1 CVEs0 on KEV0 new
VS7.8
Virus Scanner
Bitdefender
1 CVEs0 on KEV0 new
VS6.1
Vpn Standalone
Bitdefender
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-6851 | TS Total Security Bitdefender | 7.0 | Jul 14 | Improper link resolution before file access in Bitdefender Total Security via Link Following (VA-13681) |
| CVE-2026-10047 | NB Napoca bare-metal hypervisor Bitdefender | 7.8 | Jun 2 | Out-of-bounds write in Napoca real-mode hook handler via guest-controlled SS:SP (VA-13905) |
| CVE-2026-10046 | NB Napoca bare-metal hypervisor Bitdefender | 7.8 | Jun 2 | Out-of-bounds write in Napoca BIOS INT 0x15 E820 memory map handler (VA-13905) |
| CVE-2025-7073 | TS Total Security Bitdefender | 7.8 | Dec 10 | A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges |
| CVE-2025-5317 | ES Endpoint Security Bitdefender | 5.5 | Nov 11 | An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative privileges to bypass… |
| CVE-2025-1987 | SE Securepass Bitdefender | 6.1 | Jun 21 | A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass |
| CVE-2025-2245 | GU Gravityzone Update Server Bitdefender | 5.3 | Apr 4 | A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode |
| CVE-2025-2244 | GR Gravityzone Bitdefender | 9.8 | Apr 4 | A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without… |
| CVE-2025-2243 | GR Gravityzone Bitdefender | 7.3 | Apr 4 | A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests |
| CVE-2024-13872 | BF Box Firmware Bitdefender | 7.5 | Mar 12 | Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on… |
| CVE-2024-13871 | BF Box Firmware Bitdefender | 8.8 | Mar 12 | A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490) |
| CVE-2024-13870 | BF Box Firmware Bitdefender | 5.7 | Mar 12 | An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's… |
| CVE-2020-8094 | A2 Antivirus 2020 Bitdefender | 7.8 | Jan 15 | An untrusted search path vulnerability in testinitsigs.exe as used in Bitdefender Antivirus Free 2020 allows a low-privilege attacker to execute code as SYSTEM via a specially… |
| CVE-2024-11128 | VS Virus Scanner Bitdefender | 7.8 | Jan 13 | A vulnerability in the BitdefenderVirusScanner binary as used in Bitdefender Virus Scanner for MacOS may allow .dynamic library injection (DYLD injection) without being blocked by… |
| CVE-2023-49570 | TS Total Security Bitdefender | 7.4 | Oct 18 | A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to… |
| CVE-2023-6058 | TS Total Security Bitdefender | 6.8 | Oct 18 | A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections |
| CVE-2023-6057 | TS Total Security Bitdefender | 7.4 | Oct 18 | A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using the DSA signature… |
| CVE-2023-6056 | TS Total Security Bitdefender | 7.4 | Oct 18 | A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates |
| CVE-2023-6055 | TS Total Security Bitdefender | 7.4 | Oct 18 | A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificates |
| CVE-2023-49567 | TS Total Security Bitdefender | 6.8 | Oct 18 | A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate, which allows an… |
| CVE-2024-6980 | GR Gravityzone Bitdefender | 9.8 | Jul 31 | A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects… |
| CVE-2024-4177 | GR Gravityzone Bitdefender | 9.8 | Jun 6 | A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery |
| CVE-2024-2224 | ES Endpoint Security Bitdefender | 9.8 | Apr 9 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute… |
| CVE-2024-2223 | ES Endpoint Security Bitdefender | 9.8 | Apr 9 | An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay |
| CVE-2023-6154 | AN Antivirus Bitdefender | 7.8 | Apr 1 | A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows… |
| CVE-2023-3633 | EN Engines Bitdefender | 7.5 | Jul 14 | An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash. This issue affects Bitdefender Engines version 7.94791 and lower |
| CVE-2022-0357 | TS Total Security Bitdefender | 7.8 | May 24 | Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus… |
| CVE-2022-3369 | EN Engines Bitdefender | 5.5 | Nov 1 | Improper handling of registry symbolic links in Bitdefender Engines |
| CVE-2022-2830 | GR Gravityzone Bitdefender | 9.8 | Sep 5 | Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe commands to the… |
| CVE-2022-0677 | US Update Server Bitdefender | 7.5 | Apr 7 | Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update… |
| CVE-2021-4199 | AP Antivirus Plus Bitdefender | 7.8 | Mar 7 | Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, Internet Security,… |
| CVE-2021-4198 | ES Endpoint Security Tools Bitdefender | 6.1 | Mar 7 | A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools, VPN… |
| CVE-2020-8107 | TS Total Security Bitdefender | 7.8 | Feb 18 | A Process Control vulnerability in ProductAgentUI.exe as used in Bitdefender Antivirus Plus allows an attacker to tamper with product settings via a specially crafted DLL file |
| CVE-2021-3960 | GR Gravityzone Bitdefender | 7.8 | Dec 16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute… |
| CVE-2021-3959 | GR Gravityzone Bitdefender | 7.5 | Dec 16 | A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay… |
| CVE-2021-3554 | GR Gravityzone Bitdefender | 10.0 | Nov 24 | Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the… |
| CVE-2021-3553 | ES Endpoint Security Tools Bitdefender | 7.5 | Nov 24 | A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows an attacker to use the Endpoint Protection relay as a… |
| CVE-2021-3552 | ES Endpoint Security Tools Bitdefender | 7.5 | Nov 24 | A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay… |
| CVE-2021-3641 | GR Gravityzone Bitdefender | 6.1 | Nov 9 | Improper Link Resolution Before File Access ('Link Following') vulnerability in the EPAG component of Bitdefender Endpoint Security Tools for Windows allows a local attacker to… |
| CVE-2021-3823 | GR Gravityzone Bitdefender | 9.8 | Oct 28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute… |
| CVE-2021-3579 | ES Endpoint Security Tools Bitdefender | 7.8 | Oct 28 | Incorrect Default Permissions vulnerability in the bdservicehost.exe and Vulnerability.Scan.exe components as used in Bitdefender Endpoint Security Tools for Windows, Total… |
| CVE-2021-3576 | TS Total Security Bitdefender | 7.8 | Oct 28 | Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevate to 'NT AUTHORITY\System |
| CVE-2020-15732 | AP Antivirus Plus Bitdefender | 7.5 | Jun 22 | Improper Certificate Validation vulnerability in the Online Threat Prevention module as used in Bitdefender Total Security allows an attacker to potentially bypass HTTP Strict… |
| CVE-2021-3485 | ES Endpoint Security Tools Bitdefender | 6.6 | May 24 | An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the… |
| CVE-2021-3423 | GB Gravityzone Business Security Bitdefender | 7.8 | May 18 | Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allows an attacker to load a third party DLL to… |
| CVE-2020-15279 | ES Endpoint Security Tools Bitdefender | 3.3 | May 18 | An Improper Access Control vulnerability in the logging component of Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.23.320 allows a regular user to learn… |
| CVE-2020-15734 | SA Safepay Bitdefender | 5.5 | Apr 12 | An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other files in the same… |
| CVE-2020-15294 | HI Hypervisor Introspection Bitdefender | 7.0 | Dec 17 | Compiler Optimization Removal or Modification of Security-critical Code vulnerability in IntPeParseUnwindData() results in multiple dereferences to the same pointer |
| CVE-2020-15293 | HI Hypervisor Introspection Bitdefender | 5.5 | Dec 17 | Memory corruption in IntLixCrashDumpDmesg, IntLixTaskFetchCmdLine, IntLixFileReadDentry and IntLixFileGetPath due to insufficient guest-data input validation may lead to denial of… |
| CVE-2020-15292 | HI Hypervisor Introspection Bitdefender | 5.5 | Dec 17 | Lack of validation on data read from guest memory in IntPeGetDirectory, IntPeParseUnwindData, IntLogExceptionRecord, IntKsymExpandSymbol and IntLixTaskDumpTree may lead to… |
| CVE-2020-15733 | AP Antivirus Plus Bitdefender | 6.5 | Dec 14 | An Origin Validation Error vulnerability in the SafePay component of Bitdefender Antivirus Plus allows a web resource to misrepresent itself in the URL bar |
| CVE-2020-15297 | US Update Server Bitdefender | 9.1 | Nov 9 | Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to 6.6.20.294 allows an unprivileged… |
| CVE-2020-8110 | EN Engines Bitdefender | 7.5 | Oct 2 | A vulnerability has been discovered in the ceva_emu.cvd module that results from a lack of proper validation of user-supplied data, which can result in a pointer that is fetched… |
| CVE-2020-8109 | EN Engines Bitdefender | 7.5 | Oct 1 | A vulnerability has been discovered in the ace.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a write past the end of an… |
| CVE-2020-15731 | EN Engines Bitdefender | 3.6 | Sep 30 | An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location… |
| CVE-2020-8097 | ES Endpoint Security Tools Bitdefender | 7.8 | Aug 30 | An improper authentication vulnerability in Bitdefender Endpoint Security Tools for Windows and Bitdefender Endpoint Security SDK allows an unprivileged local attacker to escalate… |
| CVE-2020-8108 | ES Endpoint Security Bitdefender | 8.8 | Aug 3 | Improper Authentication vulnerability in Bitdefender Endpoint Security for Mac allows an unprivileged process to restart the main service and potentially inject third-party code… |
| CVE-2020-8102 | TS Total Security 2020 Bitdefender | 8.8 | Jun 22 | Improper Input Validation vulnerability in the Safepay browser component of Bitdefender Total Security 2020 allows an external, specially crafted web page to run remote commands… |
| CVE-2020-8103 | A2 Antivirus 2020 Bitdefender | 7.1 | Jun 5 | A vulnerability in the improper handling of symbolic links in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and restore it to a… |
| CVE-2020-8100 | EN Engines Bitdefender | 7.5 | May 15 | Improper Input Validation vulnerability in the cevakrnl.rv0 module as used in the Bitdefender Engines allows an attacker to trigger a denial of service while scanning a… |