Hacker News Reader

Indeed. I would only list driveby RCE

A vulnerability that isn't an RCE isn't necessarily shallow:

Surely that xkcd applies more to privilege escalation vulnerabilities, not plain RCE?