CVE-2026-118577

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is b0d3876247a0a64fa0e430e4b21870e41f503182. It is recommended to apply a patch to fix this issue.

• CWE-918

• https://github.com/maotoumao/MusicFreeDesktop/
• https://github.com/maotoumao/MusicFreeDesktop/commit/b0d3876247a0a64fa0e430e4b21870e41f503182
• https://github.com/maotoumao/MusicFreeDesktop/issues/443
• https://vuldb.com/cve/CVE-2026-118577
• https://vuldb.com/submit/1025070
• https://vuldb.com/vuln/428016
• https://vuldb.com/vuln/428016/cti

Published

Oct 28, 2026

Last Modified

Oct 28, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118537A vulnerability was found in a2ui up to 0.10.4. This vulnera…4.3
• CVE-2026-118538A vulnerability was determined in a2ui-project a2ui up to 0.…5.5
• CVE-2026-11854The authentication endpoint generates an error message that …6.1
• CVE-2026-11855The Simple Membership WordPress plugin before 4.7.5 does not…8.8
• CVE-2026-11856Successfully using libcurl to do a transfer to a specific HT…9.8
• CVE-2026-11857Quanos SCHEMA ST4 on-premises contains a local privilege esc…8.4
• CVE-2026-118578A security flaw has been discovered in maotoumao MusicFreeDe…4.3
• CVE-2026-118579A weakness has been identified in D-Link DIR-505 1.10B02. Th…9.8
• CVE-2026-11858Quanos SCHEMA ST4 on-premises contains a local privilege esc…8.4
• CVE-2026-118581A BSON encoding component of the MongoDB Java Driver does no…6.5
• CVE-2026-11859An HTML injection vulnerability in the "fetch links" email s…2
• CVE-2026-1186EAP Legislator is vulnerable to Path Traversal in file extra…8.6