FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data (CVE-2026-53656) | HOL Guard CVE