Best Practice for Addressing Weblogic/Tomcat Security Vulnerabilities

I am looking for recomendations for addressing Know Security Vulnerablilites with Weblogic and Tomcat. 

From the capacity planning guide the Agile team has been very specific as to Weblogic and Tomcat versions certified for each version and SP release for Agile.  In between releases, is it advisable to apply interm patches to weblogic to close some of these holes as they are found? What has worked best for you?

Thanks,

Brian