The Shibboleth Consortium publishes security advisories based on the different products, "Identity Provider V3 Security Advisories" and "Identity Provider V2 and Service Provider V2 Security Advisories".