Some operating systems like FreeBSD and (I think) Debian have this functionality built in without the need for external service. So it depends on what you are using. RedHat had a similar functionality as well AFAIR.
SUSE-based distros have it as well (zypper tells you about CVE patches and how severe they are).