There was (is?) also remote code execution on counter-strike 1.6 servers valve didn't act upon for 10+ years.