Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing (CVE-2026-34198) | HOL Guard CVE