third-party vulnerabilities