EUVD-2025-3604

Malicious code in bioql PyPI...

EUVD-2024-40753

Malicious code in bioql PyPI...

EUVD-2025-27335

Malicious code in bioql PyPI...

CVE-2025-10016

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege...

Race Condition within a Thread

Overview Affected versions of this package are vulnerable to Race Condition within a Thread via the Autoupdate helper tool. A local unprivileged attacker can gain elevated privileges by sending a very well-timed XPC message and connect to the daemon when it is spawned as root and requesting...

Race Condition within a Thread

Overview Affected versions of this package are vulnerable to Race Condition within a Thread via the Autoupdate helper tool. A local unprivileged attacker can gain elevated privileges by sending a very well-timed XPC message and connect to the daemon when it is spawned as root and requesting...

CVE-2025-10016

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege...

CVE-2025-10016 Local Privilege Escalation in Sparkle Autoupdate Daemon

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege...

CVE-2025-10016 Local Privilege Escalation in Sparkle Autoupdate Daemon

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege...

CVE-2025-10016 Local Privilege Escalation in Sparkle Autoupdate Daemon

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege...

CVE-2025-10016

The CVE-2025-10016 issue affects the Sparkle framework’s Autoupdate/Downloader.xpc mechanism. Reports in connected sources describe a local, unprivileged attacker who can exploit a race condition by connecting to the daemon as root to request installation of a crafted PKG, leading to local privil...

PT-2025-37918

Name of the Vulnerable Software and Affected Versions: Sparkle versions prior to 2.7.2 Description: The Sparkle framework’s Autoupdate tool lacks authentication for connecting clients. This allows a local, unprivileged attacker to request the installation of a crafted malicious PKG file, leading ...

CVE-2025-10016: Incorrect Authorization

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege...

The vulnerability in the Microsoft AutoUpdate (MAU) for Mac application, which allows a hacker to escalate their privileges by exploiting a flawed definition of the link before accessing the file.

The vulnerability of the Microsoft AutoUpdate MAU for Mac application relates to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow attackers to increase their privileges...

CVE-2025-55317

Improper link resolution before file access 'link following' in Microsoft AutoUpdate MAU allows an authorized attacker to elevate privileges locally...

CVE-2025-55317

Improper link resolution before file access 'link following' in Microsoft AutoUpdate MAU allows an authorized attacker to elevate privileges locally...

CVE-2025-55317

Improper link resolution before file access 'link following' in Microsoft AutoUpdate MAU allows an authorized attacker to elevate privileges locally...

CVE-2025-55317 Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability

...

CVE-2025-55317 Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability

...

CVE-2025-55317

CVE-2025-55317 concerns Microsoft AutoUpdate (MAU) and its elevation of privilege via improper link resolution before file access ("link following"). Affected: MAU components on macOS; vulnerability allows an authorized local attacker to escalate privileges. Root cause: improper link resolution b...