All issues

Search results

Add dqex to the database tools list (offline-first, single-binary DB workbench in Go)

Status: Open.

#6688 In avelino/awesome-go;

· fj1981 opened on Sep 11, 2026

avelino/awesome-go project page JSON-LD codeRepository field omits JSON escaping, letting contributor-controlled URLs close the script element and inject arbitrary script (CWE-79)

Status: Open.

#6687 In avelino/awesome-go;

· r20z19 opened on Sep 11, 2026

avelino/awesome-go site generator does not validate entry link URI schemes, letting javascript: links into category page href attributes that execute arbitrary script on a single click (CWE-79)

Status: Open.

#6686 In avelino/awesome-go;

· r20z19 opened on Sep 11, 2026

avelino/awesome-go site generator enables goldmark html.WithUnsafe and injects raw README HTML into the production homepage as template.HTML, causing stored XSS (CWE-79)

Status: Open.

#6685 In avelino/awesome-go;

· r20z19 opened on Sep 11, 2026

avelino/awesome-go site generator renders contributor-controlled entry text and repository topics through text/template without HTML escaping, causing stored XSS on the production site (CWE-79)

Status: Open.

#6684 In avelino/awesome-go;

· r20z19 opened on Sep 11, 2026

awesome-go.com pins github.com/yuin/goldmark v1.6.0: IsDangerousURL entity-encoded scheme bypass lands javascript: links in the generated site (CVE-2026-5160 / GHSA-c97m-vxhj-p7j6 / GO-2026-5320)

Status: Open.

#6675 In avelino/awesome-go;

· r20z19 opened on Sep 8, 2026

awesome-go.com pins golang.org/x/net v0.38.0: duplicate-attribute parse/render anomaly tree defeats the "Sanitize HTML" goquery roundtrip (CVE-2026-27136 / GO-2026-5030)

Status: Open.

#6674 In avelino/awesome-go;

· r20z19 opened on Sep 8, 2026

awesome-go.com build trusts a committable .cache/repos metadata cache and renders its fields unescaped: stored XSS via cache poisoning (CWE-79)

Status: Open.

#6673 In avelino/awesome-go;

· r20z19 opened on Sep 8, 2026

awesome-go.com static site generator renders README-derived content unescaped through text/template into three sink classes: stored XSS (CWE-79)

Status: Open.

#6672 In avelino/awesome-go;

· r20z19 opened on Sep 8, 2026

Bug: GoModel not listed but merged - why?

bug

pending-review

Status: Open.

#6671 In avelino/awesome-go;

· SantiagoDePolonia opened on Sep 7, 2026

Coverage link detection failure; also, mangled label

bug

pending-review

Status: Open.

#6643 In avelino/awesome-go;

· bobg opened on Aug 31, 2026

Kong library possibly mis-categorized

bug

pending-review

Status: Open.

#6592 In avelino/awesome-go;

· huntermatthews opened on Aug 17, 2026