Docling Core has unsafe remote filename resolution (CVE-2026-44023) | HOL Guard CVE