Unescaped HTML in repository list
Unescaped HTML in source list