SPDX2.3 Linking advisory: https://spdx.github.io/spdx-spec/v2.3/how-to-use/#k1-including-security-information-in-a-spdx-document Linking packages: https://spdx.github.io/spdx-spec/v2.3/external-repository-identifiers/#f2-security - CPE - GitBOM (gitoid) - PURL - SWID CycloneDX Linking advisories in vulnerabilites https://cyclonedx.org/docs/1.6/json/#vulnerabilities_items_advisories Linking packages https://cyclonedx.org/docs/1.6/json/#components_items_purl - cpe - purl - omniboard (gitoid) - swhid - swid