Priority LOW 35
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions.
CVSS 4.0HIGH 7.7· Network · No auth · User interaction · EPSS 0.00185 · Published 2026-10-10 · No fix listed CWE-352
Priority LOW 32
OpenRefine is a free, open source tool for working with messy data.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.0059 · Published 2024-10-24 · Fixed in 3.8.3 CWE-22
Priority HIGH 72
The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01638 · Published 2024-10-24 · Fixed in 1.2.6 CWE-36
Priority MEDIUM 60
OpenRefine is a free, open source tool for working with messy data.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0051 · Published 2024-10-24 · Fixed in 3.8.3 CWE-79
Priority HIGH 73
OpenRefine is a free, open source tool for working with messy data.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00689 · Published 2024-10-24 · Fixed in 3.8.3 CWE-89
Priority HIGH 70
OpenRefine is a free, open source tool for working with messy data.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00377 · Published 2024-10-24 · Fixed in 3.8.3 CWE-348
Priority HIGH 73
OpenRefine is a free, open source tool for working with messy data.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00428 · Published 2024-10-24 · Fixed in 3.8.3 CWE-352
Priority HIGH 70
OpenRefine is a free, open source tool for working with messy data.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00462 · Published 2024-10-24 · Fixed in 3.8.3 CWE-79
Priority MEDIUM 41
OpenRefine is a free, open source power tool for working with messy data and improving it.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00999 · Published 2024-02-12 · Fixed in 3.7.8 CWE-22
Priority HIGH 82
OpenRefine is a powerful free, open source tool for working with messy data.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.4254 · Published 2023-09-15 · Fixed in 3.7.5 CWE-89
Priority HIGH 72
OpenRefine is a powerful free, open source tool for working with messy data.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00997 · Published 2023-09-15 · Fixed in 3.7.5 CWE-89
Priority MEDIUM 62
OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive fil…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01384 · Published 2023-08-04 · Fixed in 3.6.0 CWE-918
Priority LOW 35
OpenRefine is a free, open source tool for data processing.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00625 · Published 2023-07-17 · Fixed in 3.7.4 CWE-22
Priority LOW 37
OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01853 · Published 2019-01-03 · No fix listed CWE-22
Priority LOW 36
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01738 · Published 2018-12-14 · No fix listed CWE-611
Priority LOW 33
OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive.
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02441 · Published 2018-12-05 · Fixed in 3.2-beta CWE-22
THREATIST.IORead the docs