Legal liability for insecure software - "write once, cause damage anywhere"

• Are there acceptable vulnerabilities?
• Liability for off-the-shelf vs. custom software
• Liability in the SaaS context