The question I'm referring to is this one.
While disabling everything but main and restricted is do-able to get for sure up to date packages...I think more people might jump in if there was a bug-need-squashing tracker that was more generally - package needs update for CVE-X.
This would be sort of like the FreeBSD portaudit
So the meat of the question: Does something like this exist?