Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations (CVE-2026-54493) | HOL Guard CVE