Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction (CVE-2026-45162) | HOL Guard CVE