CWE-1022 · Misconfiguration and Insecure Design
Use of Web Link to Untrusted Target with window.opener Access
14CVEs
SortMost likely exploited
14 CVEs with CWE-1022 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-1583External Links in New Window / New Tab < 1.43 - TabnabbingWebfactoryltd · External Links in New Window / New Tab · 2022-05-30 | – | 1.3% | 2022-05-30 |
| CVE-2021-39112Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortc…Atlassian · Jira Server · 2021-08-25 | – | 1.1% | 2021-08-25 |
| CVE-2022-2600Auto-hyperlink URLs <= 5.4.1 - Tab NabbingAuto-Hyperlink Urls Project · Auto-hyperlink URLs · 2022-08-22 | – | 0.6% | 2022-08-22 |
| CVE-2020-36624ahorner text-helpers translation.rb reverse tabnabbingahorner · text-helpers · CVSS 6.3 · 2022-12-22 | 6.3 | 0.6% | 2022-12-22 |
| CVE-2018-25089glb Meetup Tag Extension Link Attribute reverse tabnabbingglb · Meetup Tag Extension · CVSS 3.5 · 2023-08-28 | 3.5 | 0.6% | 2023-08-28 |
| CVE-2021-33697Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect users to a malicious…SAP SE · SAP BusinessObjects Business Intelligence Platform (SAPUI5) · CVSS 4.7 · 2021-09-15 | 4.7 | 0.6% | 2021-09-15 |
| CVE-2018-25058Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbingTwitter-Post-Fetcher Project · Twitter-Post-Fetcher · CVSS 4.2 · 2022-12-29 | 4.2 | 0.6% | 2022-12-29 |
| CVE-2022-4927ualbertalib NEOSDiscovery _refworks.html.erb reverse tabnabbingualbertalib · NEOSDiscovery · CVSS 5.5 · 2023-03-05 | 5.5 | 0.5% | 2023-03-05 |
| CVE-2024-39727IBM Engineering Lifecycle Optimization - Engineering Insights tabnabbingIBM · Engineering Insights · CVSS 6.1 · 2024-12-25 | 6.1 | 0.3% | 2024-12-25 |
| CVE-2026-71555PILOS: Reverse tabnabbing in room descriptionTHM-Health · PILOS · CVSS 4.1 · 2026-08-06 | 4.1 | 0.3% | 2026-08-06 |
| CVE-2025-59842JupyterLab LaTeX typesetter links did not enforce `noopener` attributejupyterlab · jupyterlab · CVSS 2.1 · 2025-09-26 | 2.1 | 0.3% | 2025-09-26 |
| CVE-2025-33014IBM Sterling B2B Integrator and IBM Sterling File Gateway link injectionIBM · Sterling B2B Integrator · CVSS 5.4 · 2025-07-18 | 5.4 | 0.3% | 2025-07-18 |
| CVE-2025-42941Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad)SAP_SE · SAP Fiori (Launchpad) · CVSS 3.5 · 2025-08-12 | 3.5 | 0.2% | 2025-08-12 |
| CVE-2025-27902IBM Db2 Recovery Expert for Linux, Unix and Windows Information DisclosureIBM · DB2 Recovery Expert for Linux, UNIX and Windows · CVSS 6.1 · 2026-10-12 | 6.1 | 0.2% | 2026-10-12 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.