How do I update core to only include security patches?
If you use Drush you can update all security issues with your site via (this is Core and 3rd party modules):
drush up --security-only

if you want to see what it will do, but not do any of the actual changes you can issue:
drush up --security-only --simulate

If you want an easy way to update Drupal Core to the newest release you can use a patch site such as:
http://fuerstnet.de/en/drupal-upgrade-easier