Hello,
 
I'm a dev in Google's Container Analysis team. We provide vulnerability scanning to customers running on GCP. We ingest those vulnerabilities through Redhat's Oval v2 xml files. We noticed that this file is missing for RHEL 9:

https://access.redhat.com/security/data/oval/v2/RHEL9/rhel-9-including-unpatched.oval.xml.bz2
 
For reference, this is what we receive for RHEL 8:
 
https://access.redhat.com/security/data/oval/v2/RHEL8/rhel-8-including-unpatched.oval.xml.bz2
 
Please advise if / when RHEL 9's vulnerabilities will be published and if you'd like me to open a ticket for this. 
 
Thanks,
Yousef