Use of Web Link to Untrusted Target with window.opener Access

Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.

1. External Links in New Window / New Tab < 1.43 - TabnabbingCVE-2022-1583Webfactoryltd · 1.3% likely

   Webfactoryltd

2. Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortc…CVE-2021-39112Atlassian · 1.1% likely

   Atlassian

3. Auto-hyperlink URLs <= 5.4.1 - Tab NabbingCVE-2022-2600Auto-Hyperlink Urls Project · 0.6% likely
4. ahorner text-helpers translation.rb reverse tabnabbingCVE-2020-36624ahorner · CVSS 6.3 · 0.6% likely
5. glb Meetup Tag Extension Link Attribute reverse tabnabbingCVE-2018-25089glb · CVSS 3.5 · 0.6% likely
6. Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect users to a malicious…CVE-2021-33697SAP SE · CVSS 4.7 · 0.6% likely

   SAP

7. Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbingCVE-2018-25058Twitter-Post-Fetcher Project · CVSS 4.2 · 0.6% likely
8. ualbertalib NEOSDiscovery _refworks.html.erb reverse tabnabbingCVE-2022-4927ualbertalib · CVSS 5.5 · 0.5% likely
9. IBM Engineering Lifecycle Optimization - Engineering Insights tabnabbingCVE-2024-39727IBM · CVSS 6.1 · 0.3% likely

   IBM

10. PILOS: Reverse tabnabbing in room descriptionCVE-2026-71555THM-Health · CVSS 4.1 · 0.3% likely

    THM-Health

11. JupyterLab LaTeX typesetter links did not enforce `noopener` attributeCVE-2025-59842jupyterlab · CVSS 2.1 · 0.3% likely

    Jupyterlab

12. IBM Sterling B2B Integrator and IBM Sterling File Gateway link injectionCVE-2025-33014IBM · CVSS 5.4 · 0.3% likely

    IBM

13. Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad)CVE-2025-42941SAP_SE · CVSS 3.5 · 0.2% likely

    SAP

14. IBM Db2 Recovery Expert for Linux, Unix and Windows Information DisclosureCVE-2025-27902IBM · CVSS 6.1 · 0.2% likely

    IBM

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.