Cursor CVE-2026-26268: Hidden Git hooks RCE via agents autonomous Git operationsnvd.nist.gov3 pointsArmor1AIa month ago