Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php (CVE-2026-34106) | HOL Guard CVE