Eugeny Tabby vulnerabilities

• eugeny tabby Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory CVE-2026-72903 8.1 HighAugust 10, 2026
• eugeny tabby Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038) CVE-2026-46709 7.8 HighJuly 15, 2026
• eugeny tabby Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution CVE-2026-45038 8.4 HighMay 15, 2026
• eugeny tabby Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh CVE-2026-45036 7.0 HighMay 15, 2026
• eugeny tabby Tabby: RCE via `tabby://run` URL Scheme CVE-2026-45035 9.4 CriticalMay 15, 2026
• eugeny tabby Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation CVE-2026-45037 7.1 HighMay 15, 2026
• eugeny tabby Tabby has a TCC Bypass via Misconfigured Node Fuses CVE-2025-22136 8.6 HighJanuary 8, 2025
• eugeny tabby Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby CVE-2024-55950 8.6 HighDecember 26, 2024