Comment by ronjakoi

But that's what Linux distros are for, package maintainers watch the CVEs for you, and all you have to do is "apt upgrade"