Where to get security advisories for your systems

Updated November 2026

Your operating system vendor is the best source for “is my server affected, and which package fixes it?”. Subscribe to its announcement list or feed for every system you run, then use CVSS, the CISA KEV catalog and EPSS to decide what to patch first.

Advisories by system

Each vendor publishes its own advisories with the exact fixed package version for each release. That version is what you compare against, not the upstream version in the news.

Things the table does not show:

• Red Hat no longer runs a public announcement list. Use the RSS feed, the CSAF/VEX files (machine-readable advisories that also cover unfixed CVEs), or the errata email settings in your Red Hat account.
• Debian does not issue a DSA for every flaw. Its security FAQ says low-impact issues can be fixed in a point release instead. The security tracker shows the status of each CVE per release.
• Alpine has no formal advisories. The tracker and secdb list which package version fixes which CVE, and scanners such as Trivy and Grype read secdb.
• Arch advisories are sparse. In November 2026 the most recent two (October 2026) followed a gap of more than a year. On a rolling release, staying fully updated matters more than reading ASAs.
• OpenBSD backports critical fixes to the two most recent releases (now 8.0 and 7.9) and announces them on the announce list.

Cross-vendor sources

oss-security mailing list

Public discussion of security flaws in open-source software, with projects, distributors and researchers as members. Many issues appear here before vendors ship packages. It is busy, so read it with filters or through the archive.

CVE.org

The CVE Program gives each flaw an ID such as CVE-2024-6387. IDs are assigned by CVE Numbering Authorities (CNAs), organizations such as vendors and CERTs that are authorized to do so for their own scope.

National Vulnerability Database (NVD)

Run by NIST, the NVD adds details such as severity scores and affected product lists to CVE records. Since April 15, 2026 it enriches only priority CVEs: those in CISA’s KEV catalog, software used by the US federal government, and “critical software”. Other CVEs are listed but marked lowest priority, and NIST no longer routinely adds its own score when the CNA already supplied one. Expect many records with the CNA’s score only.

OSV.dev

An open database that collects advisories from many ecosystems (Linux distributions, PyPI, npm, Go, crates.io and more) in one format. osv-scanner and other tools use it. Red Hat converts its CSAF data to OSV records and shares them with OSV.dev.

CVSS: how bad it could be

The Common Vulnerability Scoring System (CVSS), maintained by FIRST, scores a flaw from 0.0 to 10.0. The Base score describes the flaw’s intrinsic characteristics, which stay the same over time and across environments. The CVSS v4.0 rating scale is: None 0.0, Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0.

• It measures severity, not risk. A score of 9.8 in a module you do not load is no risk to you. The specification says to add Threat and Environmental metrics, or your own factors, for a risk decision. CVSS v4.0 labels this: CVSS-B is the base score only, CVSS-BTE includes threat and environment.
• Scores differ by source. The CNA, NVD and your distribution may score the same CVE differently, because a distribution build can be less exposed than upstream. Red Hat and SUSE also use their own Critical, Important, Moderate and Low ratings.

CISA KEV: exploited in the wild

The Known Exploited Vulnerabilities (KEV) catalog from the US Cybersecurity and Infrastructure Security Agency lists flaws that attackers have used in real attacks. An entry needs three things: a CVE ID, evidence of active exploitation (attempted or successful attacks, not just a proof of concept), and a clear fix or mitigation. Catalog version 2026.10.30 had 1,766 entries.

• Each entry has a date added, a required action, a due date and a knownRansomwareCampaignUse field (Known or Unknown).
• The due dates bind US federal civilian agencies. Since June 10, 2026 they work under Binding Operational Directive 26-04, which replaced BOD 22-01. It sets deadlines based on exposure, KEV status, whether exploitation can be automated, and technical impact. The most urgent group must be fixed within three days, plus a check for compromise. For everyone else the catalog is advice, and a good one.
• Feeds: JSON, CSV, a JSON schema, and email alerts via CISA’s subscription page.

# Is a CVE in KEV? Prints the date added and ransomware use, or nothing
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq -r '.vulnerabilities[] | select(.cveID=="CVE-2024-1086") | .dateAdded + "  ransomware: " + .knownRansomwareCampaignUse'

# Entries added in the last 7 days (GNU date)
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq -r --arg d "$(date -d '7 days ago' +%F)" '.vulnerabilities[] | select(.dateAdded >= $d) | "\(.dateAdded) \(.cveID) \(.vendorProject) \(.product)"'

EPSS: how likely exploitation is

The Exploit Prediction Scoring System (EPSS), also from FIRST, is a machine-learning model that estimates the probability that a published CVE will be exploited in the wild in the next 30 days. It publishes a score from 0 to 1 and a percentile for every CVE, every day.

• Score: 0.28 means an estimated 28% chance of exploitation activity in the next 30 days.
• Percentile: the rank against all scored CVEs. 0.98 means the score is higher than 98% of them.
• Limits: it reflects exploitation seen across the internet, not your environment. The EPSS FAQ says CVSS and EPSS measure different things and that multiplying them is “never a good idea”.

curl -s 'https://api.first.org/data/v1/epss?cve=CVE-2024-1086,CVE-2024-6387'

The kernel flaw is confirmed exploited, including by ransomware groups, yet has the lower EPSS. The OpenSSH flaw is not in KEV but has a very high EPSS. Each source catches what the others miss, so use all three.

Putting it together

1. Check you are affected. Is the package installed, at a version the vendor lists as vulnerable, and is the vulnerable feature in use?
2. In KEV: patch or mitigate now, starting with internet-facing hosts, then look for signs of compromise.
3. Not in KEV, but exposed with a High or Critical CVSS, or a high EPSS: patch within days, and re-check KEV daily in case it is added.
4. Everything else: install it in your normal update window. Automatic security updates handle most of this group with no effort.

Emergency patching covers the urgent case step by step. Vulnerability scanning shows how to find which hosts still miss a fix.

Set up your feeds today

• Subscribe one shared mailbox to the announcement list of every OS you run.
• Add the vendor RSS or Atom feeds, the KEV feed and SecureRoot’s feed to a feed reader your team checks daily.
• For the software you install outside the OS (web apps, language runtimes, control panels), follow each project’s own security announcements as well.
• Keep a list of which hosts run which OS and release, so an advisory can be matched to hosts in minutes.

Sources

• Security Information, Debian
• Debian security FAQ
• LTS Security Information, Debian
• Ubuntu Security Notices, Canonical
• Ubuntu OVAL data, Canonical
• Security data, Red Hat Customer Portal
• OVAL v2 announcement, Red Hat
• Security, SUSE
• Amazon Linux Security Center, AWS
• Alpine Linux Security Issue Tracker
• Arch Linux Security Advisories
• Security Information, FreeBSD
• OpenBSD Security and OpenBSD mailing lists
• oss-security mailing list charter, Openwall
• NIST Updates NVD Operations to Address Record CVE Growth, NIST (April 15, 2026)
• CVSS v4.0 Specification Document, FIRST
• KEV catalog criteria, CISA
• BOD 26-04: Prioritizing Security Updates Based on Risk, CISA
• Exploit Prediction Scoring System (EPSS), FIRST and EPSS FAQ
• CVE-2024-1086 and CVE-2024-6387, NVD
• OSV.dev, a distributed vulnerability database for open source