Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents (CVE-2026-49396) | HOL Guard CVE