Bitdefender

Latest CVEs · RSS

• CVE-2026-6851 2026-07-14 · CVSS 7.0
  An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet S
• CVE-2026-10047 2026-06-02 · CVSS 8.5
  The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the real-mode hook handler, implemented in napoca/kernel/handler.c
• CVE-2026-10046 2026-06-02 · CVSS 8.5
  Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/gue
• CVE-2025-7073 2025-12-10 · CVSS 8.8
  A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. Th
• CVE-2025-5317 2025-11-11 · CVSS 6.8
  An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative pr
• CVE-2025-1987 2025-06-21 · CVSS 9.3
  A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bit
• CVE-2025-2245 2025-04-04 · CVSS 6.9
  A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on
• CVE-2025-2243 2025-04-04 · CVSS 6.9
  A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characte
• CVE-2025-2244 2025-04-04 · CVSS 9.5
  A vulnerability in the sendMailFromRemoteSource method in Emails.php  as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplie
• CVE-2024-13870 2025-03-12 · CVSS 1.8
  An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrad
• CVE-2024-13871 2025-03-12 · CVSS 9.4
  A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490). This flaw all
• CVE-2024-13872 2025-03-12 · CVSS 9.4
  Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and
• CVE-2020-8094 2025-01-15 · CVSS 8.8
  An untrusted search path vulnerability in testinitsigs.exe as used in Bitdefender Antivirus Free 2020 allows a low-privilege attacker to execute code as SYSTEM
• CVE-2024-11128 2025-01-13 · CVSS 8.4
  A vulnerability in the BitdefenderVirusScanner binary as used in Bitdefender Virus Scanner for MacOS may allow .dynamic library injection (DYLD injection) witho
• CVE-2023-49570 2024-10-18 · CVSS 8.6
  A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that
• CVE-2023-49567 2024-10-18 · CVSS 8.6
  A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate,
• CVE-2023-6058 2024-10-18 · CVSS 8.6
  A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections. The issue arises when the product blocks a connection due to an untr
• CVE-2023-6057 2024-10-18 · CVSS 8.6
  A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using t
• CVE-2023-6056 2024-10-18 · CVSS 8.6
  A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates. T
• CVE-2023-6055 2024-10-18 · CVSS 8.6
  A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificate
• CVE-2024-6980 2024-07-31 · CVSS 9.2
  A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This
• CVE-2024-3297 2024-07-24 · CVSS 6.5
  An issue in the Certificate Authenticated Session Establishment (CASE) protocol for establishing secure sessions between two devices, as implemented in the Matt
• CVE-2024-3454 2024-07-24 · CVSS 3.5
  An implementation issue in the Connectivity Standards Alliance Matter 1.2 protocol as used in the connectedhomeip SDK allows a third party to disclose informati
• CVE-2024-4177 2024-06-06 · CVSS 8.1
  A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This
• CVE-2023-6324 2024-05-15 · CVSS 8.1
  ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity