Thanks, via that link I found: https://nodesecurity.io/advisories which is what I was hoping for (for client side vulns).

Not all the vulns in that advisory list get CVE numbers, so that list should be monitored in addition to CVE/NVD. And to me those JS vulns are important, for example, there was recently an XSS bug in a HTML sanitizer I'm planning to use.

(I actually went to https://nodesecurity.io/ a while ago, looking for a vulnerabilities feed, but didn't see / react-to the Advisories link at the top of the page, so I thought they didn't have any advisories list, or vuln feed.)

(The other lists seem to get CVE numbers (and will thus be included in MITRE and NVD, right). Or if they don't, they seem a bit too niche right now + I don't use them myself, so I'll skip them, for now.)