Repository navigation
Security: fleetyards/fleetyards
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
-
Public hangar stats list manufacturers of wishlist and private shipsGHSA-79vv-p7fm-x7c6 published
Oct 28, 2026 by mortikLow -
cover_image_preset path traversal reads .jpg/.png files outside the preset directoryGHSA-phh7-vm9q-w4gv published
Oct 28, 2026 by mortikLow -
Direct uploads publish client-typed content (HTML/SVG) to the public bucketGHSA-h987-pgmq-wwcg published
Oct 28, 2026 by mortikLow -
FleetEvent and Mission cover images accept SVGGHSA-4wqj-4x6r-pjch published
Oct 28, 2026 by mortikLow -
Fleet roster cable broadcasts reach invited, requested and declined membershipsGHSA-3r84-jh8x-m33m published
Oct 28, 2026 by mortikLow -
Stored XSS: squadron, shopping-list and tour names reach v-html unescapedGHSA-x28c-p97h-2gxm published
Oct 28, 2026 by mortikModerate -
Fleet Discord webhook URL accepts any URL (blind SSRF from the worker)GHSA-cqjp-mjw6-mjh2 published
Oct 28, 2026 by mortikModerate -
Removed fleet members keep mission/event slot and signup managementGHSA-qcqj-xxxp-jv87 published
Oct 28, 2026 by mortikModerate -
Revoked, expired or unscoped OAuth tokens still identify the user on public endpointsGHSA-jwgv-phhr-wv24 published
Oct 28, 2026 by mortikModerate -
Fleet officers can promote themselves to Admin and demote existing adminsGHSA-v9rw-767m-365q published
Oct 28, 2026 by mortikHigh
Learn more about advisories related to fleetyards/fleetyards in the GitHub Advisory Database