lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files (CVE-2026-41066) | HOL Guard CVE