components with known vulnerabilities