pretalx mail templates vulnerable to email injection via unescaped user-controlled placeholders (CVE-2026-41426) | HOL Guard CVE