Popular VPNs contain code execution security flaws, despite patches