VPN vulnerabilities