I subscribe to debian and openbsd security advisory email lists, which works for me generally to know what is going on in the space(s) I care more about:

https://lists.debian.org/debian-security-announce/ (this one covers security updates to many packages, but not as much as CVE advisories cover, windows, etc)

https://www.debian.org/security/

https://www.openbsd.org/mail.html (ctrl-f for security, but unlike the debian ones, this only covers patches to the base OS, not other packages).

But for you of course it would depend on what you run and what matters to you.