bug vulnerability