What’s Vulnerable › Products

Eugeny tabby vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your Eugeny tabby version is affected

Latest Eugeny tabby vulnerabilities

• CVE-2026-72903 — Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory (CVSS 8.1)
• CVE-2026-46709 — Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038) (CVSS 7.8)
• CVE-2026-45038 — Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution (CVSS 7.8)
• CVE-2026-45037 — Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation (CVSS 7.1)
• CVE-2026-45036 — Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh (CVSS 7.0)
• CVE-2026-45035 — Tabby: RCE via `tabby://run` URL Scheme (CVSS 8.8)
• CVE-2025-22136 — Tabby has a TCC Bypass via Misconfigured Node Fuses (CVSS 8.6)
• CVE-2024-55950 — Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby (CVSS 8.6)