Usually there are mailing lists you can sign up for, but they can be spammy. Organizations I have reviewed have a vulnerability scans happen every month. I thin

Usually there are mailing lists you can sign up for, but they can be spammy. Organizations I have reviewed have a vulnerability scans happen every month. I think it's a best effort kinda thing unless you have a dedicated security team monitoring daily. The juicy bugs will usually make their way into your front view like ShellShock, Heartbleed, Spectre, drupalgeddon etc. I'd say just by the willingness to ask this question and stay on top of updates you should be fine. New vulnerabilities are discovered everyday and it doesn't even include the ones that are never publicly disclosed.