Code16 Sharp vulnerabilities

• code16 sharp Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders CVE-2026-114113 8.4 HighOctober 21, 2026
• code16 sharp Sharp before 0.35.4 RCE via bundled libheif AVIF decoding CVE-2026-114112 8.9 HighOctober 21, 2026
• code16 sharp code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute CVE-2026-61823 Fix available 7.3 HighSeptember 24, 2026
• code16 sharp code16/sharp has a stored XSS via data-html-content Sanitizer Bypass CVE-2026-61825 Fix available 8.7 HighSeptember 24, 2026
• code16 sharp Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability CVE-2026-114111 Fix available 8.9 HighJuly 21, 2026
• code16 sharp Sharp: Missing Authorization Check in Quick Creation Command Endpoints CVE-2026-53634 Fix available 4.3 MediumJune 10, 2026
• code16 sharp Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint CVE-2026-44692 Fix available 7.7 HighMay 15, 2026
• code16 sharp Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil CVE-2026-33686 Fix available 8.8 HighMarch 25, 2026
• code16 sharp Sharp has Unrestricted File Upload via Client-Controlled Validation Rules CVE-2026-33687 Fix available 8.8 HighMarch 25, 2026
• code16 sharp Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax CVE-2025-62798 Fix available 5.4 MediumOctober 28, 2025
• code16 sharp Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environment CVE-2022-29256 Fix available 6.5 MediumMay 25, 2022