critical security vulnerability