Concrete does not validate a CSRF token before processing requests to `/dashboard/extend/update/do_update/<pkgHandle>` (CVE-2026-8417) | HOL Guard CVE