The recent PHP flaw is a good reminder: composer audit checks your dependencies, not the PHP runtime itself. For AI agents that need up-to-date vulnerability intelligence, cve.now is worth a look.
https://cve.now/
cve.nowcve.now: a free CVE feed for agentsA free CVE feed for agents.