Tag third-party vulnerability