qs vulnerabilities