Not every security vulnerability means you need to update right now — here's how to know which ones do