Debian provides an OVAL feed but it is quite janky and still not in line with their "advisories", which are a much more useful unit of vulnerability imo