bug bounty cve