Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository (CVE-2026-33220) | HOL Guard CVE