CISA-KEV is a good list, but updates to it can be delayed by days to months.