CUs and Security Updates - Their relationship

I have mostly SQL 2014 and SQL 2017 installations. We manually update without using WSUS nor windows update.

Unfortunately when reading the documentation on particular CUs, they do not explicitly describe that they also includeprevious released Security Updates. This causes me to question if they are included.

Example, let's say that I am at CU2 and I would like to update to CU13. Now, after CU4 there was one Security Update. I would like to update to CU13 directly. Can I update to CU13 and assume that the security update that was released after CU4 is included?

I've read documentation that describes CUs but they do not explicitly say they include previously released Security Updates.

I need help finding documentation that explicitly says that Cumulative Updates (CUs) include previous released Security Updates. If not such documentation available and you know the answer anyway, please help.

Paulino