@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default (CVE-2026-54504) | HOL Guard CVE