Advisories · Technology
Sparkle.
Every CVE that names Sparkle among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.2 Medium
Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection
- Sparkle
- Authentication bypass
- CWE-441
- CVSS 6.1 Medium
Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta
- Sparkle
- Path traversal
- CVSS 8.8 High
Local Privilege Escalation in Sparkle Autoupdate Daemon
- Sparkle
- Broken access control
- CVSS 4.8 Medium
TCC Bypass via Downloader XPC Service in Sparkle
- Sparkle
- Broken access control
- CVSS 7.3 High
Signing Checks Bypass
- Sparkle
- Information disclosure