high2026-10-29 CVE-2026-62264-@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY GHSA-q344-5v34-gm84