I have taken a somewhat different approach in the past.

Given that Linux distributors are actively monitoring upstream sources for new releases I used the package management system (in my case yast as I was running SuSe) from the command line to list any required updates.

I didn't trust this blindly; instead I sample checked a history of updates comparing the delay between the CVE being published and an update being published. The gap was in the region of 3 days on average. However I do acknowledge that a patch being released quickly is not guaranteed and that there is often other mitigations available other than waiting for a fix from the supplier (something several large software companies do not seem to acknowledge).

I am no export on apt, but I expect it should be possible to identify the required updates using aptitude.

I have taken a somewhat different approach in the past.

Given that Linux distributors are actively monitoring upstream sources for new releases I used the package management system (in my case yast as I was running SuSe) from the command line to list any required updates.

I didn't trust this blindly; instead I sample checked a history of updates comparing the delay between the CVE being published and an update being published. The gap was in the region of 3 days on average. However I do acknowledge that a patch being released quickly is not guaranteed and that there is often other mitigations available other than waiting for a fix from the supplier (something several large software companies do not seem to acknowledge).

I am no export on apt, but I expect it should be possible to identify the required updates using aptitude.