EUVD-2019-15831

Malware in sbrugna...

EUVD-2020-2450

Malware in sbrugna...

EUVD-2020-16703

Malware in sbrugna...

EUVD-2015-4693

Malware in sbrugna...

EUVD-2025-10133

Malicious code in bioql PyPI...

EUVD-2025-2423

Malicious code in bioql PyPI...

EUVD-2022-2969

Malicious code in bioql PyPI...

EUVD-2025-17718

Malicious code in bioql PyPI...

EUVD-2022-3568

Malicious code in bioql PyPI...

EUVD-2025-3604

Malicious code in bioql PyPI...

EUVD-2025-27335

Malicious code in bioql PyPI...

EUVD-2025-10136

Malicious code in bioql PyPI...

EUVD-2025-29539

Malicious code in bioql PyPI...

EUVD-2024-40753

Malicious code in bioql PyPI...

CVE-2025-10016

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege...

Race Condition within a Thread

Overview Affected versions of this package are vulnerable to Race Condition within a Thread via the Autoupdate helper tool. A local unprivileged attacker can gain elevated privileges by sending a very well-timed XPC message and connect to the daemon when it is spawned as root and requesting...

Race Condition within a Thread

Overview Affected versions of this package are vulnerable to Race Condition within a Thread via the Autoupdate helper tool. A local unprivileged attacker can gain elevated privileges by sending a very well-timed XPC message and connect to the daemon when it is spawned as root and requesting...

CVE-2025-10016

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege...

CVE-2025-10016

The CVE-2025-10016 issue affects the Sparkle framework’s Autoupdate/Downloader.xpc mechanism. Reports in connected sources describe a local, unprivileged attacker who can exploit a race condition by connecting to the daemon as root to request installation of a crafted PKG, leading to local privil...

CVE-2025-10016 Local Privilege Escalation in Sparkle Autoupdate Daemon

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege...