Only two remote code execution vulnerabilities in the default configuration. But that's not the only type of security bug.
They're trolling me. :)