{"uuid": "1338e7f8-3e45-4016-8136-b2888544f32f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54722", "type": "seen", "source": "https://bsky.app/profile/kynth.studio/post/3mruwkbv7zy2r", "content": "dssrf's SSRF bypass (CVE-2026-54722): it strips '@' from the raw URL string before new URL() parses it, so the hostname gets corrupted and internal IPs are never checked. Validate parser output, never raw text. #software", "creation_timestamp": "2026-07-30T17:08:56.046967Z"}