if you run debsecan on even a fully patched Debian machine you'll see why CVEs are not so helpful from a practical "get this machine fully patched" POV