Thanks! This gives me the impression that the NVD RSS feed, or alternatively the cve.mitre.org changelog (they contain the same vulns, I think), is an okay vul

Thanks! This gives me the impression that the NVD RSS feed, or alternatively the cve.mitre.org changelog (they contain the same vulns, I think), is an okay vuln list to monitor, and that that one alone will be enough, now initially, when getting started. Because: The main source mentioned on the Debian tracker, seems to be cve.mitre.org. And at cve.mitre.org, there's this page: cve.mitre.org/cve/data_updates.html which recommends NVD or MITRE's own change log. More things that came to my mind, when looking at the sources linked from the Debian tracker: - NVD: lots of details on the vulnerability. In a format that looks easy to parse for a web scraper. - LWN.net: There's an email about the vuln, but it seems time consuming to read it and understand what to do with it (the email). - Vulnerability Notes Database (CERT): Found nothing about the vuln. - Exploit Database: Nothing. - Metasploit: Nothing. - Red Hat / Ubuntu / Gentoo /SuSE / Mageia feels a bit too distro specific to monitor now initially. - Full Disclosure & Bugtraq: Nothing, vs "too many" detailed emails, sometimes about individual product versions. B.t.w. how kind of security-tracker.debian.org to include all those Source links :-) Ok, initially, it'll be NVD's RSS feed, or MITRE's change log, e.g.: https://cassandra.cerias.purdue.edu/CVE_changes/CVE.2016.08.html https://cassandra.cerias.purdue.edu/CVE_changes/CVE.2016.08.... + some other Git repositories not yet popular enough (?) to be included by MITRE, and some Javascript + Java & Scala stuff that I use.