When was the last RCE that didn't involve running Javascript on an untrusted URL?