To learn quickly when a library in your AI stack has a new advisory, keep an up to date SBOM, match it automatically against public advisory databases, add a check against the CISA Known Exploited Vulnerabilities catalog, and route alerts to a named owner. The inventory matters most, because you cannot match what you have not listed.
Step 1: know what you run
Generate an SBOM for each service and image, not just for the repo. Include transitive packages. Update it on every build so it reflects what is deployed. Without it, an advisory announcement becomes a manual hunt through repositories.
Step 2: watch the right sources
| Source | What it gives you |
|---|---|
| GitHub Advisory Database | Reviewed advisories for ecosystems including pip, npm, Go, and Maven, in OSV format with a GHSA ID |
| OSV | Aggregated OSV format data, queryable by package and version through an API, with a first-party scanner |
| CISA KEV catalog | Vulnerabilities known to be exploited in the wild, described by CISA as an input to prioritisation |
| Project security pages | Early notice from maintainers of your key libraries |
Note a limit: GitHub's unreviewed advisories are imported from the National Vulnerability Database without review, and Dependabot does not alert on them. Do not rely on a single feed.
Step 3: match and rank
Match your SBOM against these sources on a schedule and when new data arrives. Rank by reachability and exposure, then add KEV status as an override. See how to triage CVEs in ML packages.
Step 4: decide who is told
Give each service an owner. Send critical, reachable items to chat and the ticket queue. Send the rest to a weekly digest. An alert nobody owns is noise.
Step 5: practice the response
Run a drill: pick a recent advisory in a library you use and time how long it takes to answer "are we affected, where, and what is the fix?" The first drill usually shows gaps in the inventory.
What about zero days?
An advisory appears after disclosure. For issues with no advisory yet, watch maintainer channels and reputable security news for your core libraries, and consider tooling that discovers issues before a CVE exists.
Try it yourself
Open the zero day watch demo and look at how a new disclosure is matched to affected projects.
Click through it at your own pace, or open it full screen.
A short note on Safeguard
Safeguard offers zero-day discovery, SBOM and dependency scanning, and reachability analysis. Try a free scan at gold.safeguard.sh/scan.
Quick check
Is Dependabot enough?
It covers GitHub reviewed advisories for repos it can see. You still need image scanning and a view of what is deployed.
How fast should we react to a KEV listing?
Treat it as urgent and verify exposure the same day.
Sources
Last reviewed: 19 October 2026.
