I typically do this to check if specific CVE's have had patches released to them via 'rpm -q --changelog <package> | grep <cve-number>'