Skip to content
OpenAdvisories

Vendor

sparkle-project

5 known vulnerabilities.

Products

Sparkle 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2025-10016

    Local Privilege Escalation in Sparkle Autoupdate Daemon

    The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as ro…

    sparkle-project Sparkle
  • High 7.3
    CVE-2025-0509

    Signing Checks Bypass

    A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

    sparkle-project Sparkle openjdk-9 openjdk-13 Ubuntu Wolfi SwiftURL