Open source vulnerabilities