tabby records
5 published records for vendor tabby.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')2
- CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences1
- CWE-184 Incomplete List of Disallowed Inputs1
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
5 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
37Monitor | CVE-2026-45035No exploit | Tabby: RCE via `tabby://run` URL Schemetabby · tabby · CWE-78 | Critical9.4 | — | 0.4% | May 15, 2026 |
33Monitor | CVE-2026-45038No exploit | Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Executiontabby · tabby · CWE-150 | High8.4 | — | 0.1% | May 15, 2026 |
31Monitor | CVE-2026-46709No exploit | Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)tabby · tabby · CWE-77 | High7.8 | — | 0.2% | Jul 15, 2026 |
28Monitor | CVE-2026-45037No exploit | Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocationtabby · tabby · CWE-184 | High7.1 | — | 0.2% | May 15, 2026 |
28Monitor | CVE-2026-45036No exploit | Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zshtabby · tabby · CWE-78 | High7.0 | — | 0.1% | May 15, 2026 |
- CVE-2026-4503537Monitor
Tabby: RCE via `tabby://run` URL Scheme
CriticalCVSS 9.4No exploitEPSS 0%tabby · tabbyMay 15, 2026
- CVE-2026-4503833Monitor
Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution
HighCVSS 8.4No exploitEPSS 0%tabby · tabbyMay 15, 2026
- CVE-2026-4670931Monitor
Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)
HighCVSS 7.8No exploitEPSS 0%tabby · tabbyJul 15, 2026
- CVE-2026-4503728Monitor
Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation
HighCVSS 7.1No exploitEPSS 0%tabby · tabbyMay 15, 2026
- CVE-2026-4503628Monitor
Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh
HighCVSS 7.0No exploitEPSS 0%tabby · tabbyMay 15, 2026