open source vulnerabilties