https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-fram...
Releases without cve patches used to be quite common, max ive seen before were 3