open source vulnerability