As for the CVEs: you just need to install from your OS’s package manager and run periodic updates. The communities take care of this very well.