Confusion resolving NuGet package vulnerabilities

Every once in a while, I get a message in Visual Studio telling me that one or more packages I'm using is out of date with vulnerabilities. But I find the process of resolving the issue confusing.

Issue 1

The only way I've found to update a package is select all the projects that directly include it, uninstall the current package, and then install the new one. However, this is a major pain as uninstalling the package removes it from the list.

Now I must go and find that package again, make sure it is the right variation I was using before, remember which projects were referencing it so I can select them, and then I can finally install the new version. There are cases where it took a lot of time to ensure I was referencing the right library, and this process could easily cause me to mess that up!

Surely this wasn't the intended process. What am I doing wrong?

Issue 2

My second issue is that one of the packages only has transitive packages. Since I have no way to select a project that directly references the package, I don't seem to have any way to uninstall it.