This gives me the impression that the NVD RSS feed, or alternatively the cve.mitre.org changelog (they contain the same vulns, I think), is an okay vuln list to monitor, and that that one alone will be enough, now initially, when getting started.
Because: The main source mentioned on the Debian tracker, seems to be cve.mitre.org. And at cve.mitre.org, there's this page: cve.mitre.org/cve/data_updates.html which recommends NVD or MITRE's own change log.
More things that came to my mind, when looking at the sources linked from the Debian tracker:
- NVD: lots of details on the vulnerability. In a format that looks easy to parse for a web scraper.
- LWN.net: There's an email about the vuln, but it seems time consuming to read it and understand what to do with it (the email).
- Vulnerability Notes Database (CERT): Found nothing about the vuln.
- Exploit Database: Nothing.
- Metasploit: Nothing.
- Red Hat / Ubuntu / Gentoo /SuSE / Mageia feels a bit too distro specific to monitor now initially.
- Full Disclosure & Bugtraq: Nothing, vs "too many" detailed emails, sometimes about individual product versions.
Ok, initially, it'll be NVD's RSS feed, or MITRE's change log, e.g.: https://cassandra.cerias.purdue.edu/CVE_changes/CVE.2016.08....
+ some other Git repositories not yet popular enough (?) to be included by MITRE, and some Javascript + Java & Scala stuff that I use.