Hacker News Reader

TLDR: severity is denial of service (as of today) for all of them

But if you actually read the descriptions there are plenty that look like they'd have great potential for code execution.