I don&#x27;t quite understand why people are upset with this. This is common in every, single Linux distro. Some vulnerabilities are simply not worth patching. Debian also has quite a few unpatched issues:<p><a href="https:&#x2F;&#x2F;security-tracker.debian.org&#x2F;tracker&#x2F;status&#x2F;unreported" rel="nofollow">https:&#x2F;&#x2F;security-tracker.debian.org&#x2F;tracker&#x2F;status&#x2F;unreporte...</a><p>And CentOS doesn&#x27;t even publish that data because it would probably terrify you...<p>The fact is that not all vulnerabilities are equal. Some silly crashing bug in Wireshark cannot be equated to an easily-exploitable RCE in some widely used library. I am pretty sure most of the latter are fixed everywhere, whereas the former should be ignored. If your use case really really requires fixing such low importance issues, then patch it yourself, or pay support fees to someone who will do it for you.<p>And the fact that Debian patches some issues but Ubuntu does not is simply a question of how much work has been put into it. If a Debian pkg maintainer releases a new version, there is no guarantee that it doesn&#x27;t break some other functionality. Simply patching without putting serious work into it is the trait of community distros like Debian and Fedora. Ubuntu, I assume, must go through a much more grueling process to get fixes out. Use whichever fits your use case...