Server-Side Request Forgery

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

1. ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLsCVE-2026-85686modelscope · CVSS 7.5 · 0.5% likely

   CWE-918

2. modelscope agentscope Internal Service _common.py _get_bytes_from_web_url server-side request forgeryCVE-2026-6605modelscope · CVSS 7.3 · 0.3% likely

   CWE-918

3. modelscope agentscope _agent_base.py _process_audio_block server-side request forgeryCVE-2026-6606modelscope · CVSS 7.3 · 0.3% likely

   CWE-918

4. modelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgeryCVE-2026-6604modelscope · CVSS 7.3 · 0.3% likely

   CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.