CVE WatchAug 20, 2026

CVE-2025-14601

An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operati

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0-100

Published: Aug 20, 2026 · Last modified: Aug 20, 2026 · CWE-676

EPSS · 30d

Not enough EPSS history yet.

Technical description

An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.

Official references

github.comhttps://github.com/klsecservices/Advisories/blob/master/KLSA-00343-vsDesk-Task-Scheduler-OS-Command-Injection.md

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-145014.3 MED

24.3%

——7IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions.9d CVE-2026-544997.5 HIG

27.5%

——8Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt torch.load(..., weights_only=True) but fall back to torch.load(..., weights_only=False) on attacker-controllable pickle.UnpicklingError, allowing a malicious .pt pretrain or model file to execute arbitrary pickle code when a Stanza NLP pipeline loads it. This issue is fixed in version 1.12.2.38d