CVE-2026-72903High 8.1Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory0.5%
CVE-2026-46709High 7.8Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)0.3%
CVE-2026-45038High 8.4Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution0.2%
CVE-2026-45036High 7.0Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh0.1%
CVE-2026-45035Critical 9.4Tabby: RCE via `tabby://run` URL Scheme0.4%
CVE-2026-45037High 7.1Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation0.1%
CVE-2025-22136High 8.6Tabby has a TCC Bypass via Misconfigured Node Fuses0.4%
CVE-2024-55950High 8.6Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby0.3%