Drush or Drupal console command to list modules with security updates?
drush pm:security should be fine in listing Drupal modules with security updates.

There was a bug from the drupal-composer/drupal-security-advisories project that resulted in not listing the forms_steps module and some other modules.  It was promptly fixed and now it works!