https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-49760.htmlhttps://patchthecve.com/cve/CVE-2024-49760.htmlWed, 17 Jun 2026 08:00:23 +0000HIGH 7.1: OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it constructs the path of the localization file to load, of the form `translations-$LANG.json`. But when doing so in versions prior to 3.8.3, it does not check that thehttps://patchthecve.com/cve/CVE-2024-47883.htmlhttps://patchthecve.com/cve/CVE-2024-47883.htmlWed, 17 Jun 2026 07:57:54 +0000CRITICAL 9.1: The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the `java.net.URL` class to refer to (what are expected to be) local resource files, like images or templates. This works: "opening a connection" to these URLs opens the local https://patchthecve.com/cve/CVE-2024-47882.htmlhttps://patchthecve.com/cve/CVE-2024-47882.htmlWed, 17 Jun 2026 07:57:54 +0000MEDIUM 5.9: OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an errorhttps://patchthecve.com/cve/CVE-2024-47881.htmlhttps://patchthecve.com/cve/CVE-2024-47881.htmlWed, 17 Jun 2026 07:57:54 +0000HIGH 8.1: OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the `database` extension, the "enable_load_extension" property can be set for the SQLite integration, enabling an attacker to load (local or remote) extension DLLs and so rhttps://patchthecve.com/cve/CVE-2024-47880.htmlhttps://patchthecve.com/cve/CVE-2024-47880.htmlWed, 17 Jun 2026 07:57:54 +0000HIGH 8.1: OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker could lead a user to a malicious page thahttps://patchthecve.com/cve/CVE-2024-47879.htmlhttps://patchthecve.com/cve/CVE-2024-47879.htmlWed, 17 Jun 2026 07:57:54 +0000HIGH 7.6: OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expression` command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contahttps://patchthecve.com/cve/CVE-2024-47878.htmlhttps://patchthecve.com/cve/CVE-2024-47878.htmlWed, 17 Jun 2026 07:57:54 +0000HIGH 8.1: OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint includes the `state` GET parameter verbatim in a `<script>` tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL contaihttps://patchthecve.com/cve/CVE-2024-23833.htmlhttps://patchthecve.com/cve/CVE-2024-23833.htmlWed, 17 Jun 2026 07:13:42 +0000HIGH 7.5: OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7) where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the newer MySQL driver library in the latest ve