LOW3.1PyPIGHSA-r7w7-9xr2-qq2r· CVE-2026-41488, PYSEC-2026-76langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebindingModified: 6/6/2026