sparkle-project records
3 published records for vendor sparkle-project.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 33.3%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-306 Missing Authentication for Critical Function1
- CWE-552 Files or Directories Accessible to External Parties1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
3 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
27Monitor | CVE-2025-0509No exploit | Signing Checks Bypasssparkle-project · sparkle · CWE-552 | Medium6.8 | 0.8%Feb 4, 2025 |
24Monitor | CVE-2026-47121No exploit | Sparkle: Binary delta apply intermediate-symlink traversal in malicious .deltasparkle-project · sparkle · CWE-22 | Medium6.1 | 0.3%Jul 21, 2026 |
16Monitor | CVE-2026-47122No exploit | Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injectionsparkle-project · sparkle · CWE-306 | Medium4.2 | 0.1%Jul 21, 2026 |
- CVE-2025-050927Monitor
Signing Checks Bypass
MediumCVSS 6.8No exploitEPSS 0%sparkle-project · sparkleFeb 4, 2025
- CVE-2026-4712124Monitor
Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta
MediumCVSS 6.1No exploitEPSS 0%sparkle-project · sparkleJul 21, 2026
- CVE-2026-4712216Monitor
Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection
MediumCVSS 4.2No exploitEPSS 0%sparkle-project · sparkleJul 21, 2026