critical vulnerability