Skip to content
SSparkle Project
Products
| Product | CVEs | Exploited | Latest |
|---|
| Sparkle | 5 | – | Jul 21, 2026 |
Exploited and recent CVEs
-
CVE-2026-47122
Medium 4.2
Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection
0.1%
-
CVE-2026-47121
Medium 6.1
Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta
0.3%
-
CVE-2025-10016
High 8.8
Local Privilege Escalation in Sparkle Autoupdate Daemon
0.2%
-
CVE-2025-10015
Medium 4.8
TCC Bypass via Downloader XPC Service in Sparkle
0.2%
-
CVE-2025-0509
High 7.3
Signing Checks Bypass
0.9%