open-source vulnerabilities