[umvi]

External C++ code never has CVEs? Or I guess since you are manually managing it, you are just ignorant of any CVEs?

[drnick1]

I suppose this largely depends on the kind of software that you write. Ideally, you also extract only the part of the external code that you need, audit it, and integrate it into your own code. This way you minimize the attack surface. I don't work on software that is exposed to the Internet however, so admittedly the importance of security vulnerabilities is low.