How do you stay informed about new CVEs and security updates?

For whatever reason I am having a hard time coming up with a reliable way to keep on top of newly discovered vulnerabilities. I initially had the idea of adding an RSS feed to my jira/confluence dashboard, but atlassian make this way more difficult than it needs to be.

While it's not a common occurrence, there are times that I am notified of vulnerabilities within our systems from colleagues outside of my team. Of course I am open to their observations and input, but I can't help but feel a little embarrassed that I did not discover them first.

I am curious as to how this is handled in other businesses. Do you have a good way of tracking these events?

Edit: formatting