CVEScan analyzes an Ubuntu system to check whether all available security patches have been installed. CVEScan produces a clear, concise report that tells you which, if any, security patches an Ubuntu system may be missing.
In addition to scanning a local system, CVEScan can scan a package manifest file. This is useful in environments where CVEScan cannot be installed on every system.
sudo snap install cvescan
Usage Information ->
See https://github.com/canonical/sec-cvescan for more details