List installed packages:
dpkg -l
Update local database of packages (SystemUpdate will do this by itself):
apt-get update
Missing patches (full debug log - requires apt-get update first):
apt upgrade --dry-run 2>/dev/null | grep ^Inst
List missing patches (requires apt-get update first. To get the number of missing patches you can pass the output to wc -l):
Security patches:
apt upgrade --dry-run 2>/dev/null | grep ^Inst | grep \-security
Hotfixes:
apt upgrade --dry-run 2>/dev/null | grep ^Inst | grep -v \-security