Open WebUI: Any authenticated user can read other users' private notes via Socket.IO (CVE-2026-54022) | HOL Guard CVE