A security advisory is an official notice, usually from the vendor or maintainer, that describes a security flaw in their software and tells users what to do about it. It is the primary source for a vulnerability, and news coverage and social posts are built from it.
A good advisory names the flaw and its type, gives a CVE or GHSA ID, rates the severity, lists the affected component and versions, names the fixed version, and describes any workaround. It often credits the researcher who reported the problem and gives dates for the report, the fix and the publication.
Advisories appear on vendor websites, on GitHub, in security mailing lists, in release announcements and in notices from national bodies such as CERTs. Linux distributions publish their own advisories for the packages they maintain.
Read the advisory itself before acting. Check that your version is in the affected range, look for a revision history because details are sometimes updated after publication, and follow its exact instructions. If a headline sounds more alarming than the advisory, trust the advisory.