While CERT does a lot of testing on their own and they have found some vulnerabilities most of their information comes from other internet sources, such as bugtraq, or vendor security lists. They...