There is currently a scary number of vulnerability tracking systems, all doing pretty much the same work. One can find a list of most popular ones at [http://cve.mitre.org/cve/refs/refkey.html CVE Reference Key page]. We could expect better security from having so many projects, but in fact the net result is that we don't have any comprehensive source of information. Aggregators like CVE, Secunia and SecurityFocus, help track security issues, but none of them is complete, and it's not very easy to find relevant info when you get five or more secunia advisories for a bug in some wide-spread library - and all of them are about OS updates, not the lib in question.