Beyond Metadata: Code-centric and Usage-based Analysis of Known Vulnerabilities in Open-source Software.