Vulnerabilities

TI-2026-34714 CVE-2026-47122 · GHSA-g3hp-f6mg-559v

Missing authentication in sparkle-project Sparkle

LOW 18

Sparkle is a software update framework for macOS.

CVSS 3.1MEDIUM 4.2 Local Low privileges No interaction EPSS 0.00105 Published 2026-07-21 No fix listed CWE-306

TI-2026-34713 CVE-2026-47121 · GHSA-hg88-v3cw-3qrh

MEDIUM 60

Sparkle is a software update framework for macOS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00339 Published 2026-07-21 Fixed in 2.9.2 CWE-22

TI-2025-09194 CVE-2025-10016 · GHSA-8hp9-4f9g-73rv

LOW 37

The Sparkle framework includes a helper tool Autoupdate.

CVSS 4.0HIGH 8.8 Local Low privileges No interaction EPSS 0.00198 Published 2025-09-16 Fixed in 2.7.2 CWE-863

TI-2025-09193 CVE-2025-10015 · GHSA-fvpx-gx3c-pq7f

LOW 21

The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00171 Published 2025-09-16 Fixed in 2.7.2 CWE-863

TI-2025-00423 CVE-2025-0509 · GHSA-wc9m-r3v6-9p5h

LOW 36

A security issue was found in Sparkle before version 2.6.4.

CVSS 3.1HIGH 7.3 Adjacent network High privileges User interaction EPSS 0.00904 Published 2025-02-04 Fixed in 2.6.4 CWE-552