Using components with known vulnerabilities