[MEDIUM] code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check

PKSA-mbr7-229z-zc1f CVE-2026-84987 GHSA-g6f8-c3x9-jv7f

Affected version: >=10.0.0-beta.1,<10.0.0-beta.4|<9.23.0

Reported by:
GitHub

[MEDIUM] code16/sharp: Arbitrary class instantiation through the embed_key API parameter

PKSA-tzfc-wx9k-qbx7 CVE-2026-84974 GHSA-h24v-f482-8cwf

Affected version: >=10.0.0-beta.1,<10.0.0-beta.4|<9.23.0

Reported by:
GitHub

[HIGH] code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

PKSA-735v-pwws-tf2j CVE-2026-61823 GHSA-qxg3-46rw-79j8

Affected version: <9.22.5

Reported by:
GitHub

[HIGH] code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

PKSA-p6zx-3z97-z7f8 CVE-2026-61825 GHSA-vj3q-vp3g-j9c8

Affected version: <9.22.5

Reported by:
GitHub

[MEDIUM] Sharp Missing Authorization Check in Quick Creation Command Endpoints

PKSA-krdf-j5zz-ky6v CVE-2026-53634 GHSA-vmwx-m75v-qvch

Affected version: >=9.0.0,<9.22.3

Reported by:
GitHub

[HIGH] Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint

PKSA-h9kt-ss6k-xq4z CVE-2026-44692 GHSA-748w-hm6r-qc7v

Affected version: <9.22.0

Reported by:
GitHub

[HIGH] Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil

PKSA-48kw-4xx3-wpfb CVE-2026-33686 GHSA-9ffq-6457-8958

Affected version: <9.20.0

Reported by:
GitHub

[HIGH] Sharp has Unrestricted File Upload via Client-Controlled Validation Rules

PKSA-74vs-2hzw-xc7y CVE-2026-33687 GHSA-fr76-5637-w3g9

Affected version: <9.20.0

Reported by:
GitHub

[MEDIUM] Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax

PKSA-w3x4-3yd5-pjjx CVE-2025-62798 GHSA-9f58-4465-23c7

Affected version: <9.11.1

Reported by:
GitHub