Security update for python3

This update for python3 fixes the following issues: Security fixes: CVE-2025-4517: Fixed arbitrary filesystem writes outside the extraction directory during extraction with filter="data" bsc1244032 CVE-2025-4330: Fixed extraction filter bypass for linking outside extraction directory bsc1244060...

CVE-2025-12449

CVE-2025-12449 (aBlocks – Gutenberg Blocks, WordPress Plugin) The vulnerability arises from missing capability checks on multiple AJAX actions in the aBlocks WordPress plugin (versions up to 2.4.0). This allows authenticated users with subscriber level access and above to modify data and disclose...

CVE-2021-47702: Cross-Site Request Forgery (CSRF)

OpenBMCS 2.4 contains a CSRF vulnerability that allows attackers to perform actions with administrative privileges by exploiting the sendFeedback.php endpoint. Attackers can submit malicious requests to trigger unintended actions, such as sending emails or modifying system settings...

MAL-2025-189072 Malicious code in radiometric-proxima-ophiuchus-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42e4cebbe5b73c636c28c777ed6499e4fb906fcc3ffa5a700a0f16cd85821770 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in void-uglify-warn-export-zero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a289220d5fd74e336a5702c92af3412df6ca9b1feea3e4847d79f92987df0c7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184738 Malicious code in oloc-yg-uthgai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30d5540f0b83deeb125d6796db3e6d0d52c2c6873fdfba379bdae72536f52f9f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kisut-diufg-danuamffoa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce5760eae659fba47723d88f4ec100f4cf544f5522f5f2dcb17e7c4e6ccccc9b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181177 Malicious code in @akunsansan0/batu13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b835595d79d352ff2f989dc04be6ed4e61d405c4ab31ea6ccb50502a1a1891 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/karedok10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 760fc35764b8672f159948588133673e83cadc18879c568c392864d3b7e9199c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-afucug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f6b64423df5b6c94eb87ba08f7f9736ccf745a8843ef006f173b25898efa6d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181092 Malicious code in teate-thy-sonic-werduw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9eaf25423193252f213ace05a1e99366ce435ba30ed93b6bb4e5a6430faec1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-ifza (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd5e00ab354d822596f6e38d5719546b78591deef69be645056072e16a487f35 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-180736 Malicious code in teate-thy-sonic-nesba (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce4266381f4bd8f22e37d6a50ceab8021f24544df121cb054aaae0cd7ddbce3d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-uspu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f3a862466a70b91383810542d10cd364283adff37bc26802abba060d6dffd9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polymer-buya (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5c21098ff9fa8981f1b26aab19a78e8c0e6d1ceccec3a7f1bacf7c9c7bf840b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nuilva-vmiam-rbua (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34e6ac2e88af9d360c884b30a022c28539fd411bdcb65edd462b5e24697a536a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-172925 Malicious code in anidata-hapdits-rso (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fadd64cc11061ba2d5cf18cafa85754dde67d1cf8dfb1bed71fc22d7288151a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in poglymer-ogmimh-avigpafdg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 400b24f734d2e498ef7f649c944edeca90edb3e38b6e006d55d10937216bf04f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in butahu-asfi-dsusu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6161832d931049c150dd622e2ffcc19954a5765fa5ddf2fa2e1ae164983db468 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-178353 Malicious code in rusd-setya-rusmaya (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d41fc4d8cdc92dfbcd581e3bc4aca03f4132e16262650d97442a7e1af5ee84c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...