The Shibboleth Consortium publishes security advisories based on the different products at "Identity Provider V3 Security Advisories", Service Provider V3 Security Advisories and the old "Identity Provider V2 and Service Provider V2 Security Advisories".

The SimpleSAMLphp developers publishes security advisories at SimpleSAMLphp Security Advisories.