Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB (CVE-2026-49360) | HOL Guard CVE