Kirby: Arbitrary Method Call via REST API search and collection query endpoints (CVE-2026-44174) | HOL Guard CVE