Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension (CVE-2026-12856) | HOL Guard CVE