sparkle-project Sparkle
5 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-47122 | <= 2.9.1 | Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection | MEDIUM 4.2 | 0.1 % | ||
| CVE-2026-47121 | < 2.9.2 | Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta | MEDIUM 6.1 | 0.3 % | ||
| CVE-2025-10016 | < 2.7.2 | Local Privilege Escalation in Sparkle Autoupdate Daemon | HIGH 8.8 | 0.2 % | ||
| CVE-2025-10015 | < 2.7.2 | TCC Bypass via Downloader XPC Service in Sparkle | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-0509 | < 2.6.4 | Signing Checks Bypass | HIGH 7.3 | 0.9 % |