PatchClock

PHP security digest · Packages

code16/sharp security advisories

2 advisories we have followed since September 2026, 2 of them critical or high, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. High 25 Sep 2026

    code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

    Fixed in 9.22.5 · CVE-2026-61823

  2. High 25 Sep 2026

    code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

    Fixed in 9.22.5 · CVE-2026-61825

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including code16/sharp, and the version that fixes it.