using components with known vulnerabilities