Study: Open source poses security risks