browsing the packages list on www.netbsd.org, i noticed the
section about known security vulnerabilities in the package
man pages.  poking around a little, i noticed a target
"show-vulnerabilities" in bsd.pkg.mk, but..

# make show-vulnerabilities
make: don't know how to make show-vulnerabilities. Stop

i'm not in the mood to decipher bsd.pkg.mk to find out why i
get this, and besides, it's obvious that i am missing the
"vulnerabilities" files anyway, and i can't seem to find any
clue as to where to get it.

anyhow, i am not sure that this is intended to do what i
want: something that reports known vulnerabilities affecting
installed packages.  Moreover, i think this should be added
to /etc/daily..

help? :)