open source security vulnerabilities