open source vulnerability detection