Tracking known security vulnerabilities in third-party components