Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover (CVE-2026-45627) | HOL Guard CVE