Sparkle Project Sparkle

• CVE-2026-47122 Medium 4.2 Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection 0.1%
• CVE-2026-47121 Medium 6.1 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta 0.3%
• CVE-2025-10016 High 8.8 Local Privilege Escalation in Sparkle Autoupdate Daemon 0.2%
• CVE-2025-10015 Medium 4.8 TCC Bypass via Downloader XPC Service in Sparkle 0.2%
• CVE-2025-0509 High 7.3 Signing Checks Bypass 0.9%