Full CVE lists:
http://cve.mitre.org/data/downloads/

CVEs that do not affect sarge (maintained by regular security team):
http://www.debian.org/security/nonvulns-sarge

Ultra Monkey kernel security database:
http://www.ultramonkey.org/bugs/cve/