Vendor
OpenRefine
16 known vulnerabilities in products by OpenRefine, 0 of them actively exploited (CISA KEV).
Key figures
16
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2023-41887 | Remote Code exec in project import with mysql jdbc url attack | 9.8 | |
| Critical | CVE-2024-47883 | Butterfly has path/URL confusion in resource handling leading to multiple weaknesses | 9.1 | |
| Medium | CVE-2018-19859 | OpenRefine: Path Traversal | 6.5 | |
| High | CVE-2019-3580 | OpenRefine: Path Traversal | 7.5 | |
| High | CVE-2018-20157 | OpenRefine: XML External Entity (XXE) | 7.5 | |
| Medium | CVE-2022-41401 | OpenRefine: Server-Side Request Forgery (SSRF) | 6.5 | |
| High | CVE-2024-23833 | OpenRefine JDBC Attack Vulnerability | 7.5 | |
| High | CVE-2023-41886 | OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack | 7.5 | |
| High | CVE-2024-47881 | OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE) | 8.1 | |
| High | CVE-2026-108553 | OpenRefine through 3.10.1 CSRF to RCE via get-rows Command | 7.5 | |
| High | CVE-2024-49760 | OpenRefine has a path traversal in LoadLanguageCommand | 7.1 | |
| High | CVE-2024-47878 | Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt) | 8.1 | |
| High | CVE-2024-47879 | OpenRefine: Code Injection | 7.6 | |
| High | CVE-2024-47880 | OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand | 8.1 | |
| Medium | CVE-2024-47882 | OpenRefine: Improper Neutralization of Script in an Error Message Web Page | 5.9 | |
| High | CVE-2023-37476 | Zip slip in OpenRefine | 5.5 |
Products
| OpenRefine | 15 | 0 |