Practically any package that you install has a list of vulnerabilities in it, so it's either vulnerable or you can't install it.
I've also run:
Code:
cd /usr/pkgsrc
cvs update -dP
and it's been a few days now and not one problem has been fixed. Python was updated, but both the last version and the newest version have vulnerabilities.