"Known security vulnerability" needs little more information:

In fact, I think there should be a link to the detected security vulnerability, or a short description.