Best place(s) to be kept updated on security flaws in softwares.

Question

Where should one go to be kept updated on all of the security flaws/problems floating around? Specially in the era of open source where we tend to use libraries from everywhere.

Answer 1

Here's a quick list:

• CVE
• Security Focus
• Secunia
• CERT
• FrSIRT
• SecWatch
• OWASP

Answer 2

• Defense Information Systems Agency - Information Assurance Support Environment
• Defense Information Systems Agency - Security Technical Implementation Guides
• Defense Information Systems Agency - Security Readiness Review Evaluation Scripts

I find these links useful as a defense contractor, but they might have use for civilian applications as well. Look at the SRR scripts as a way to detect possible vulnerabilities on a system you are trying to secure.