Security advisory infrastructure

The identifiers, feeds and databases that tell operators which versions of which software are vulnerable, including CVE records, OSV entries and the scanners that consume them.