Login Request a demo
TA
Product
tabby
by Eugeny · last CVE Aug 10, 2026
8
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 0High 8Medium 0Low 0
Severity
All severities8Critical0High8Medium0Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add tabby to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-45035
8.8
0%
May 15
Tabby: RCE via `tabby://run` URL Scheme
Affected: < 1.0.233
CVE-2025-22136
8.6
0%
Jan 8
Tabby has a TCC Bypass via Misconfigured Node Fuses
Affected: < 1.0.217
CVE-2024-55950
8.6
0%
Dec 26
Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby
Affected: < 1.0.216
CVE-2026-72903
8.1
0%
Aug 10
Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory
Affected: < 1.0.235
CVE-2026-46709
7.8
0%
Jul 15
Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)
Affected: < 1.0.234
CVE-2026-45038
7.8
0%
May 15
Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution
Affected: < 1.0.233
CVE-2026-45037
7.1
0%
May 15
Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation
Affected: < 1.0.232
CVE-2026-45036
7.0
0%
May 15
Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh
Affected: < 1.0.233
Showing 8