Vulnerability can be used to run attacker code and install software, requiring no user interaction beyond normal browsing.

There's several of those. They're also fixed in the ESR (10.x) releases.