NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal (CVE-2026-14628) | HOL Guard CVE