Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence (CVE-2026-3408) | HOL Guard CVE