CWE-1022 · 18 records

Use of Web Link to Untrusted Target with window.opener Access

CVEs in this class

18 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2024-39727No exploit	IBM Engineering Lifecycle Optimization - Engineering Insights tabnabbingibm · engineering lifecycle optimization - engineering insights · CWE-1022 Pre-auth	Critical9.8	—	0.3%	Dec 25, 2024
26Monitor	CVE-2022-1583No exploit	External Links in New Window / New Tab < 1.43 - Tabnabbingwebfactoryltd · external links in new window \/ new tab · CWE-1022 Pre-auth	Medium6.5	—	1.3%	May 30, 2022
26Monitor	GHSA-588m-9qg5-35pqNo exploit	Reverse Tabnabbing in quillnpm · quill · CWE-1022 Pre-auth	Medium6.5	—	—	Sep 3, 2020
24Monitor	CVE-2020-36624No exploit	ahorner text-helpers translation.rb reverse tabnabbingtexthelpers project · texthelpers · CWE-1022 Pre-auth	Medium6.1	—	0.6%	Dec 22, 2022
24Monitor	CVE-2021-33697No exploit	Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attsap · businessobjects business intelligence · CWE-1022 Pre-auth	Medium6.1	—	0.5%	Sep 15, 2021
24Monitor	CVE-2018-25058No exploit	Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbingtwitter-post-fetcher project · twitter-post-fetcher · CWE-1022 Pre-auth	Medium6.1	—	0.5%	Dec 29, 2022
24Monitor	CVE-2022-4927No exploit	ualbertalib NEOSDiscovery _refworks.html.erb reverse tabnabbingualberta · neosdiscovery · CWE-1022 Pre-auth	Medium6.1	—	0.4%	Mar 5, 2023
24Monitor	CVE-2025-33014No exploit	IBM Sterling B2B Integrator and IBM Sterling File Gateway link injectionibm · sterling b2b integrator · CWE-1022 Pre-auth	Medium6.1	—	0.2%	Jul 18, 2025
24Monitor	CVE-2025-27902No exploit	IBM Db2 Recovery Expert for Linux, Unix and Windows Information Disclosureibm · db2 recovery expert for linux, unix and windows · CWE-1022 Pre-auth	Medium6.1	—	0.1%	Oct 12, 2026
21Monitor	CVE-2022-2600No exploit	Auto-hyperlink URLs <= 5.4.1 - Tab Nabbingauto-hyperlink urls project · auto-hyperlink urls · CWE-1022 Pre-auth	Medium5.4	—	0.6%	Aug 22, 2022
21Monitor	CVE-2018-25089No exploit	glb Meetup Tag Extension Link Attribute reverse tabnabbingglb · meetup tag · CWE-1022 Pre-auth	Medium5.3	—	0.6%	Aug 28, 2023
19Monitor	CVE-2021-39112No exploit	Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnappatlassian · data center · CWE-1022	Medium4.8	—	0.9%	Aug 24, 2021
17Monitor	GHSA-x9p2-fxq6-2m5fNo exploit	Reverse Tabnapping in swagger-uinpm · swagger-ui · CWE-1022 Pre-auth	Medium4.3	—	—	Jun 20, 2019
16Monitor	CVE-2026-71555No exploit	PILOS: Reverse tabnabbing in room descriptionthm-health · pilos · CWE-1022	Medium4.1	—	0.2%	Aug 6, 2026
14Monitor	CVE-2025-42941No exploit	Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad)sap_se · sap fiori (launchpad) · CWE-1022	Low3.5	—	0.2%	Aug 11, 2025
12Monitor	GHSA-h6mq-3cj6-h738No exploit	Reverse Tabnabbing in showdownnpm · showdown · CWE-1022 Pre-auth	Low3.1	—	—	Sep 3, 2020
8Monitor	CVE-2025-59842No exploit	JupyterLab LaTeX typesetter links did not enforce `noopener` attributejupyter · jupyterlab · CWE-1022 Pre-auth	Low2.1	—	0.2%	Sep 26, 2025
0Monitor	GHSA-xcxh-6cv4-q8p8No exploit	HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploitnpm · hfs · CWE-1022 Pre-auth	Low	—	—	Aug 12, 2025

CVE-2024-39727
39Monitor
IBM Engineering Lifecycle Optimization - Engineering Insights tabnabbing
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
ibm · engineering lifecycle optimization - engineering insightsDec 25, 2024
CVE-2022-1583
26Monitor
External Links in New Window / New Tab < 1.43 - Tabnabbing
MediumCVSS 6.5No exploitEPSS 1%
- Pre-auth
webfactoryltd · external links in new window \/ new tabMay 30, 2022
GHSA-588m-9qg5-35pq
26Monitor
Reverse Tabnabbing in quill
MediumCVSS 6.5No exploit
- Pre-auth
npm · quillSep 3, 2020
CVE-2020-36624
24Monitor
ahorner text-helpers translation.rb reverse tabnabbing
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
texthelpers project · texthelpersDec 22, 2022
CVE-2021-33697
24Monitor
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated att
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
sap · businessobjects business intelligenceSep 15, 2021
CVE-2018-25058
24Monitor
Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbing
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
twitter-post-fetcher project · twitter-post-fetcherDec 29, 2022
CVE-2022-4927
24Monitor
ualbertalib NEOSDiscovery _refworks.html.erb reverse tabnabbing
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
ualberta · neosdiscoveryMar 5, 2023
CVE-2025-33014
24Monitor
IBM Sterling B2B Integrator and IBM Sterling File Gateway link injection
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
ibm · sterling b2b integratorJul 18, 2025
CVE-2025-27902
24Monitor
IBM Db2 Recovery Expert for Linux, Unix and Windows Information Disclosure
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
ibm · db2 recovery expert for linux, unix and windowsOct 12, 2026
CVE-2022-2600
21Monitor
Auto-hyperlink URLs <= 5.4.1 - Tab Nabbing
MediumCVSS 5.4No exploitEPSS 0%
- Pre-auth
auto-hyperlink urls project · auto-hyperlink urlsAug 22, 2022
CVE-2018-25089
21Monitor
glb Meetup Tag Extension Link Attribute reverse tabnabbing
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
glb · meetup tagAug 28, 2023
CVE-2021-39112
19Monitor
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapp
MediumCVSS 4.8No exploitEPSS 0%
atlassian · data centerAug 24, 2021
GHSA-x9p2-fxq6-2m5f
17Monitor
Reverse Tabnapping in swagger-ui
MediumCVSS 4.3No exploit
- Pre-auth
npm · swagger-uiJun 20, 2019
CVE-2026-71555
16Monitor
PILOS: Reverse tabnabbing in room description
MediumCVSS 4.1No exploitEPSS 0%
thm-health · pilosAug 6, 2026
CVE-2025-42941
14Monitor
Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad)
LowCVSS 3.5No exploitEPSS 0%
sap_se · sap fiori (launchpad)Aug 11, 2025
GHSA-h6mq-3cj6-h738
12Monitor
Reverse Tabnabbing in showdown
LowCVSS 3.1No exploit
- Pre-auth
npm · showdownSep 3, 2020
CVE-2025-59842
8Monitor
JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
LowCVSS 2.1No exploitEPSS 0%
- Pre-auth
jupyter · jupyterlabSep 26, 2025
GHSA-xcxh-6cv4-q8p8
0Monitor
HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit
LowNo exploit
- Pre-auth
npm · hfsAug 12, 2025

All vulnerability classes