Vulnerability detection and confirmation