pop vulnerability