Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs (CVE-2026-49865) | HOL Guard CVE