# cve.now: Bitdefender

The newest entries naming Bitdefender as an affected vendor (up to 200), of 82 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-118448](https://cve.now/CVE-2026-118448.md): Uninitialized output buffer returned after nd\_to\_text failure in pybddisasm (CVSS 6.9)
- [CVE-2026-118447](https://cve.now/CVE-2026-118447.md): Uninitialized INSTRUX contents returned after decoding failure in pybddisasm (CVSS 4.8)
- [CVE-2026-118446](https://cve.now/CVE-2026-118446.md): Use-after-free in INSTRUX array members in pybddisasm (CVSS 6.9)
- [CVE-2026-118445](https://cve.now/CVE-2026-118445.md): Use-after-free in INSTRUX structure members in pybddisasm (CVSS 6.9)
- [CVE-2026-118444](https://cve.now/CVE-2026-118444.md): Out-of-bounds reads during instruction decoding in pybddisasm (CVSS 4.8)
- [CVE-2026-6851](https://cve.now/CVE-2026-6851.md): Improper link resolution before file access in Bitdefender Total Security via Link Following (VA-13681) (CVSS 7.0)
- [CVE-2026-10047](https://cve.now/CVE-2026-10047.md): Out-of-bounds write in Napoca real-mode hook handler via guest-controlled SS:SP (VA-13905) (CVSS 8.5)
- [CVE-2026-10046](https://cve.now/CVE-2026-10046.md): Out-of-bounds write in Napoca BIOS INT 0x15 E820 memory map handler (VA-13905) (CVSS 8.5)
- [CVE-2025-7073](https://cve.now/CVE-2025-7073.md): Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security (CVSS 8.8)
- [CVE-2025-5317](https://cve.now/CVE-2025-5317.md): Improper access restriction to critical folder in Bitdefender Endpoint Security Tools for Mac (CVSS 6.8)
- [CVE-2025-1987](https://cve.now/CVE-2025-1987.md): Stored XSS in Psono-Client via Malicious Vault Entry URLs (CVSS 9.3)
- [CVE-2025-2245](https://cve.now/CVE-2025-2245.md): Server Side Request Forgery in GravityZone Update Server Using Null Bytes (VA-12646) (CVSS 6.9)
- [CVE-2025-2243](https://cve.now/CVE-2025-2243.md): SSRF in GravityZone Console via DNS Truncation (VA-12634) (CVSS 6.9)
- [CVE-2025-2244](https://cve.now/CVE-2025-2244.md): Insecure PHP deserialization issue in GravityZone Console (VA-12634) (CVSS 9.5)
- [CVE-2024-13870](https://cve.now/CVE-2024-13870.md): Unauthenticated Firmware Downgrade in Bitdefender Box v1 (CVSS 1.8)
- [CVE-2024-13871](https://cve.now/CVE-2024-13871.md): Unauthenticated Command Injection in Bitdefender BOX v1 (CVSS 9.4)
- [CVE-2024-13872](https://cve.now/CVE-2024-13872.md): Bitdefender Box Insecure Update Mechanism Vulnerability in libboxhermes.so (CVSS 9.4)
- [CVE-2020-8094](https://cve.now/CVE-2020-8094.md): Untrusted Search Path Vulnerability in Bitdefender Antivirus Free 2020 (VA-8422) (CVSS 8.8)
- [CVE-2024-11128](https://cve.now/CVE-2024-11128.md): Insufficient Hardened Runtime or Library Validation signing in Bitdefender Virus Scanner for macOS (CVSS 8.4)
- [CVE-2023-49570](https://cve.now/CVE-2023-49570.md): Insecure Trust of Basic Constraints certificate in Bitdefender Total Security HTTPS Scanning (VA-11210) (CVSS 8.6)
- [CVE-2023-49567](https://cve.now/CVE-2023-49567.md): Insecure Trust of certificates using collision hash functions in Bitdefender Total Security HTTPS Scanning (VA-11239) (CVSS 8.6)
- [CVE-2023-6058](https://cve.now/CVE-2023-6058.md): HTTPS Certificate Validation Issue in Bitdefender Safepay (VA-11167) (CVSS 8.6)
- [CVE-2023-6057](https://cve.now/CVE-2023-6057.md): Insecure Trust of DSA-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11166) (CVSS 8.6)
- [CVE-2023-6056](https://cve.now/CVE-2023-6056.md): Insecure Trust of Self-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11164) (CVSS 8.6)
- [CVE-2023-6055](https://cve.now/CVE-2023-6055.md): Improper Certificate Validation in Bitdefender Total Security HTTPS Scanning (VA-11158) (CVSS 8.6)
- [CVE-2024-6980](https://cve.now/CVE-2024-6980.md): Verbose error handling issue in GravityZone Update Server proxy service (CVSS 9.2)
- [CVE-2024-4177](https://cve.now/CVE-2024-4177.md): Host whitelist parser issue in GravityZone Console On-Premise (VA-11554) (CVSS 8.1)
- [CVE-2024-2224](https://cve.now/CVE-2024-2224.md): Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466) (CVSS 8.1)
- [CVE-2024-2223](https://cve.now/CVE-2024-2223.md): Incorrect Regular Expression in GravityZone Update Server (VA-11465) (CVSS 8.1)
- [CVE-2023-6154](https://cve.now/CVE-2023-6154.md): Local privilege escalation in Bitdefender Total Security (VA-11168) (CVSS 7.8)
- [CVE-2023-3633](https://cve.now/CVE-2023-3633.md): Out of Bounds Memory Corruption Issue in CEVA Engine (CVSS 8.1)
- [CVE-2022-0357](https://cve.now/CVE-2022-0357.md): Improper Quoting Path Issue in Bitdefender Total Security (CVSS 6.7)
- [CVE-2022-3369](https://cve.now/CVE-2022-3369.md): Improper handling of registry symbolic links in Bitdefender Engines (CVSS 8.6)
- [CVE-2022-2830](https://cve.now/CVE-2022-2830.md): Deserialization of Untrusted Data in GravityZone Console On-Premise (VA-10573) (CVSS 8.8)
- [CVE-2022-0677](https://cve.now/CVE-2022-0677.md): Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144) (CVSS 7.5)
- [CVE-2021-4199](https://cve.now/CVE-2021-4199.md): Incorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017) (CVSS 7.8)
- [CVE-2021-4198](https://cve.now/CVE-2021-4198.md): messaging\_ipc.dll NULL Pointer Dereference in multiple Bitdefender products (VA-10016) (CVSS 6.1)
- [CVE-2020-8107](https://cve.now/CVE-2020-8107.md): Process Control vulnerability in Bitdefender Antivirus Plus (CVSS 8.2)
- [CVE-2021-3960](https://cve.now/CVE-2021-3960.md): Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-10146) (CVSS 7.1)
- [CVE-2021-3959](https://cve.now/CVE-2021-3959.md): Server-Side Request Forgery in Bitdefender GravityZone Update Server in Relay Mode (VA-10145) (CVSS 6.8)
- [CVE-2021-3553](https://cve.now/CVE-2021-3553.md): Server-Side Request Forgery in EPPUpdateService remote config file (VA-9825) (CVSS 5.3)
- [CVE-2021-3554](https://cve.now/CVE-2021-3554.md): Improper Access Control vulnerability in the patchesUpdate API (CVSS 9.0)
- [CVE-2021-3552](https://cve.now/CVE-2021-3552.md): Insufficient validation on regular expression in EPPUpdateService config file (VA-9825) (CVSS 5.3)
- [CVE-2021-3641](https://cve.now/CVE-2021-3641.md): Improper Link Resolution Before File Access in Bitdefender GravityZone (VA-9921) (CVSS 6.1)
- [CVE-2021-3823](https://cve.now/CVE-2021-3823.md): Path traversal vulnerability in Bitdefender GravitZone Update Server in relay mode (CVSS 7.1)
- [CVE-2021-3576](https://cve.now/CVE-2021-3576.md): Privilege escalation via SeImpersonatePrivilege (CVSS 7.8)
- [CVE-2021-3579](https://cve.now/CVE-2021-3579.md): Incorrect Default Permissions vulnerability in bdservicehost.exe and Vulnerability.Scan.exe (CVSS 7.8)
- [CVE-2020-15732](https://cve.now/CVE-2020-15732.md): Improper Certificate Validation vulnerability in the Online Threat Prevention module as used in Bitdefender Total Security allows an attacke (CVSS 6.5)
- [CVE-2021-3485](https://cve.now/CVE-2021-3485.md): Improper Input Validation in Bitdefender Endpoint Security Tools for Linux (CVSS 6.4)
- [CVE-2021-3423](https://cve.now/CVE-2021-3423.md): Privilege escalation in Bitdefender GravityZone Business Security (CVSS 7.8)
- [CVE-2020-15734](https://cve.now/CVE-2020-15734.md): Same-origin policy vulnerability in Bitdefender Safepay (CVSS 5.5)
- [CVE-2020-15293](https://cve.now/CVE-2020-15293.md): Memory corruption in Bitdefender Hypervisor Introspection (VA-9336) (CVSS 6.1)
- [CVE-2020-15294](https://cve.now/CVE-2020-15294.md): Compiler Optimization Removal or Modification of Security-Critical Code vulnerability in Bitdefender Hypervisor Introspection (VA-9339) (CVSS 7.8)
- [CVE-2020-15292](https://cve.now/CVE-2020-15292.md): Lack of validation on data read from guest memory in Bitdefender HVI (VA-9333) (CVSS 5.5)
- [CVE-2020-15733](https://cve.now/CVE-2020-15733.md): URL Spoofing Vulnerability in Bitdefender SafePay (VA-8958) (CVSS 6.5)
- [CVE-2020-15297](https://cve.now/CVE-2020-15297.md): Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to (CVSS 7.1)
- [CVE-2020-8110](https://cve.now/CVE-2020-8110.md): Bitdefender ceva\_emu.cvd module denial-of-service (VA-8766) (CVSS 5.9)
- [CVE-2020-8109](https://cve.now/CVE-2020-8109.md): Bitdefender ace.xmd parser out-of-bounds write (VA-8772) (CVSS 5.9)
- [CVE-2020-15731](https://cve.now/CVE-2020-15731.md): Local Privilege Escalation in Bitdefender Engines (VA-8953) (CVSS 3.2)
- [CVE-2020-8097](https://cve.now/CVE-2020-8097.md): Improper authentication vulnerability in Bitdefender Endpoint Security Tools and Endpoint Security SDK (VA-8646) (CVSS 8.1)
- [CVE-2020-8108](https://cve.now/CVE-2020-8108.md): Insufficient client validation in Bitdefender Endpoint Security for Mac (VA-8759) (CVSS 8.2)
- [CVE-2020-8102](https://cve.now/CVE-2020-8102.md): Insufficient URL sanitization and validation in Safepay Browser (VA-8631) (CVSS 8.8)
- [CVE-2020-8103](https://cve.now/CVE-2020-8103.md): Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8604) (CVSS 7.2)
- [CVE-2020-8100](https://cve.now/CVE-2020-8100.md): Incomplete validation in detection code in Bitdefender Engines (VA-8589) (CVSS 9.0)
- [CVE-2020-8099](https://cve.now/CVE-2020-8099.md): Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8387) (CVSS 7.1)
- [CVE-2020-8096](https://cve.now/CVE-2020-8096.md): Untrusted Search Path Vulnerability in High-Level Antimalware SDK (CVSS 6.3)
- [CVE-2020-8095](https://cve.now/CVE-2020-8095.md): Bitdefender Total Security Link Resolution Denial-of-Service Vulnerability (CVSS 4.9)
- [CVE-2020-8093](https://cve.now/CVE-2020-8093.md): Code Injection into Bitdefender AV for Mac (CVSS 5.3)
- [CVE-2020-8092](https://cve.now/CVE-2020-8092.md): Privilege escalation in Bitdefender AV for Mac (CVSS 1.6)
- [CVE-2019-17096](https://cve.now/CVE-2019-17096.md): Bitdefender BOX 2 bootstrap get\_image\_size command injection vulnerability (CVSS 9.0)
- [CVE-2019-17099](https://cve.now/CVE-2019-17099.md): Untrusted Search Path vulnerability in EPSecurityService.exe (VA-3500) (CVSS 5.3)
- [CVE-2019-17095](https://cve.now/CVE-2019-17095.md): Bitdefender BOX 2 bootstrap download\_image command injection vulnerability (CVSS 8.1)
- [CVE-2019-17103](https://cve.now/CVE-2019-17103.md): Get-task-allow entitlement via BDLDaemon on macOS (CVSS 4.9)
- [CVE-2019-17102](https://cve.now/CVE-2019-17102.md): Bitdefender BOX v2 bootstrap update\_setup command execution vulnerability (VA-2226) (CVSS 8.3)
- [CVE-2019-17100](https://cve.now/CVE-2019-17100.md): Untrusted Search Path vulnerability in Bitdefender Total Security 2020 (VA-5895) (CVSS 5.2)
- [CVE-2019-6738](https://cve.now/CVE-2019-6738.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. (CVSS 8.8)
- [CVE-2019-6737](https://cve.now/CVE-2019-6737.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. (CVSS 8.8)
- [CVE-2019-6736](https://cve.now/CVE-2019-6736.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. (CVSS 8.8)
- [CVE-2017-17410](https://cve.now/CVE-2017-17410.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. (no CVSS)
- [CVE-2017-17409](https://cve.now/CVE-2017-17409.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. (no CVSS)
- [CVE-2017-17408](https://cve.now/CVE-2017-17408.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. (no CVSS)
- [CVE-2017-10954](https://cve.now/CVE-2017-10954.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security Internet S (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/bitdefender
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.