Aas-ee open-webSearch

• CVE-2026-42260 High 8.2 Open-WebSearch: SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname` 0.3%