https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-49760.htmlhttps://patchthecve.com/cve/CVE-2024-49760.htmlWed, 17 Jun 2026 08:00:23 +0000HIGH 7.1: OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it constructs the path of the localization file to load, of the form `translations-$LANG.json`. But when doing so in versions prior to 3.8.3, it does not check that thehttps://patchthecve.com/cve/CVE-2024-47882.htmlhttps://patchthecve.com/cve/CVE-2024-47882.htmlWed, 17 Jun 2026 07:57:54 +0000MEDIUM 5.9: OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an errorhttps://patchthecve.com/cve/CVE-2024-47881.htmlhttps://patchthecve.com/cve/CVE-2024-47881.htmlWed, 17 Jun 2026 07:57:54 +0000HIGH 8.1: OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the `database` extension, the "enable_load_extension" property can be set for the SQLite integration, enabling an attacker to load (local or remote) extension DLLs and so rhttps://patchthecve.com/cve/CVE-2024-47880.htmlhttps://patchthecve.com/cve/CVE-2024-47880.htmlWed, 17 Jun 2026 07:57:54 +0000HIGH 8.1: OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker could lead a user to a malicious page thahttps://patchthecve.com/cve/CVE-2024-47879.htmlhttps://patchthecve.com/cve/CVE-2024-47879.htmlWed, 17 Jun 2026 07:57:54 +0000HIGH 7.6: OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expression` command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contahttps://patchthecve.com/cve/CVE-2024-47878.htmlhttps://patchthecve.com/cve/CVE-2024-47878.htmlWed, 17 Jun 2026 07:57:54 +0000HIGH 8.1: OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint includes the `state` GET parameter verbatim in a `<script>` tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL contai