I need to list (not count or install) all pending security updates on an Ubuntu 14.04 system. I've read the post How to create a list of of only security updates with apt-get? and its accepted answer (apt-show-versions | grep upgradeable | grep security) does indeed give me a list.

However, that command lists 62 pending security updates. /usr/lib/update-notifier/apt-check tells me that I have 75 pending security updates, but doesn't seem to have a way to list them. How can I reconcile these two numbers? Is one of the two commands doing something other than what I want?


If you are just looking to do this quickly once, instead of creating a separate repository and scripting up some automation and all that. Great if you aren't supposed to be making changes while auditing a system or whatever.

These two commands will spit out the list. Pipe to wc -l to see how many are behind. ;-)

grep security /etc/apt/sources.list > /tmp/security.list
sudo apt-get upgrade -oDir::Etc::Sourcelist=/tmp/security.list -oDir::Etc::SourceParts=/some/valid/dir/false -s

Still valid for older distros or if you have update repos off, but security on:

sudo apt-get upgrade -s| grep ^Inst |grep Security 
| improve this answer | |
  • why do you write ”Still valid for older distros or if you have update repos off, but security on“? if the piped solution does not work, maybe add the -V (-verbose-versions) option? – myrdd Jan 7 '19 at 11:04
  • @myrdd Because the first uses features that weren't available on distros that were going out of style back in 2016. Might not be a thing anymore. – flickerfly Jan 8 '19 at 17:00
  • so the latter solution should always work, no? – myrdd Jan 9 '19 at 8:43
  • 1
    @myrdd As long as the format of the output doesn't change in a newer version. The first is better because it isn't dependent upon format of output. – flickerfly Jan 17 '19 at 18:07
|                            Command                            |                                                                               Purpose                                                                               |
| apt list --upgradable                                         | List all updates available                                                                                                                                          |
| apt list --upgradable | grep "\-security"                     | List all updates that are security.                                                                                                                                 |
| apt list --upgradable 2>/dev/null | grep "\-security" | wc -l | Count number of security updates available. and redirects the stderr like "WARNING: apt does not have a stable CLI interface. Use with caution in scripts." to null |
| improve this answer | |
  • This is not entirely correct. On a system of ours, it lists 7 packages, while /usr/lib/update-notifier/apt-check lists 12 security updates. Too bad it cannot list them. – Reinier Post May 11 at 11:17
  • Works for me in a pinch. Thanks for the tip! – pepoluan Oct 21 at 4:30

This worked for me:

sudo unattended-upgrade --dry-run -d 2> /dev/null | awk '/Checking/ { print $2 }'
| improve this answer | |
  • 2
    Shows all available updates, but doesnt limit to security-updates if i'm not mistaken. Still helpful. – delf Aug 27 '18 at 14:04
sudo apt-get -s --no-download dist-upgrade -V | grep "^Inst.*security.*$" | cut -d " " -f 2

With some help from this question

| improve this answer | |

there must be a way to request how many packages are updatable and how many security updates right now, but if you settle for asking it once a day you can simply read the file /var/lib/update-notifier/updates-available, which seems to be updated daily by the script /etc/cron.daily/update-notifier-common which belongs to the package update-notifier-common


$ sudo cat /var/lib/update-notifier/updates-available

355 packages can be updated.
1 update is a security update.

Tested in:

  • Ubuntu 14.04 LTS
  • Ubuntu 16.04 LTS
  • Ubuntu 18.04 LTS



| improve this answer | |
sudo apt list --upgradable |grep "/$(lsb_release -cs)-security"

This lists all available updates which come via the security repository.

| improve this answer | |
  • 1
    apt is for interactive use. You get a warning when used in a script. Use apt-get instead. – Bernard Feb 11 '19 at 6:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.