This is a list of various open source software projects with links to security contacts for the project. Please only list those projects that do have a security contact to list! The contact may be an email address or a web page with more information.

The list should be maintained in alphabetical order.

• Reports of non-public security issues in any Apache product to private list security [at] apache [dot] org
• Apache HTTP Server security pages: http://httpd.apache.org/security_report.html
• Apache Tomcat security pages: http://tomcat.apache.org/security.html

• Security contact: security [at] asterisk [dot] org
• Issues may also be tracked at http://bugs.digium.com (but please set the bug to “private” until a fix is committed)
• Security announcements will be posted at http://www.asterisk.org/security/

• ClamAV bug tracker
• RSS-feed for advisories http://www.clamav.net/lang/en/feed
• Contact information http://www.clamav.net/lang/en/contacts/

• Security contact: security [at] cups [dot] org

• Contact procedures
• RSS-feed for advisories split into three feeds Core, Contributed projects, Public Service Announcements
• Security team information http://drupal.org/security-team

• Security contact: security [at] gnome [dot] org

• Security contact: security [at] kde [dot] org
• Advisories and contact information: http://www.kde.org/info/security/

• Security contact: libressl [dash] security [at] openbsd [dot] org

• Security contact: security [at] kernel [dot] org

Please refer to Documentation/SecurityBugs in a recent Linux kernel source tree for up-to-date information on how to best report security bugs in the Linux kernel, as well as on the public disclosure policy.

• Web site: http://mantisbt.org/
• Development team contact: mantisbt [dash] dev [at] lists [dot] sourceforge [dot] net (warning: this is a public list, do not report sensitive security issues here)
• Refer to the Security issues handling process page on the MantisBT wiki for detailed instructions on how to report security issues.

• Contact information: http://web.mit.edu/kerberos/contact.html (Security Contact section)
• Advisories: http://web.mit.edu/kerberos/www/advisories/

• How to report a vulnerability: http://docs.mongodb.org/manual/tutorial/create-a-vulnerability-report/
• Known vulnerabilities: http://www.mongodb.org/about/alerts/#security-related

• Report security issues to http://tracker.moodle.org/ with the security level appropriately (bugs classified as a “Serious security issue” will only be visible to the security team).
• Advisories: http://moodle.org/mod/forum/view.php?id=7128

• Reports of non-public security issues in Mozilla products may be mailed to security [at] mozilla [dot] org
• Known vulnerabilities: http://www.mozilla.org/projects/security/known-vulnerabilities.html

• Security bugs should be filed in OpenLDAP Issue Tracking System, which allows ticking “Major Security Issue?” making bug only visible to core team: http://www.openldap.org/its/
• Additional contact information: http://www.openldap.org/project/

• Report issue to private list: openssh [at] openssh [dot] com
• For more details, see: http://openssh.org/report.html

• Report issues to private list openssl [dash] security [at] openssl [dot] org
• List of vulnerabilities fixed http://www.openssl.org/news/vulnerabilities.html

• Bugzilla
• Announce mailing list (low traffic, includes security update announces):
  • List info
  • List archives
  • Subscribe: email to announce [dash] join [at] openvz [dot] org
• Security contact: security [at] openvz [dot] org

• Security contact: security [at] piwik [dot] org
• Advisories: http://piwik.org/blog/category/security/

• Security contact and update information: http://www.samba.org/samba/history/security.html

• Advisories: http://www.squid-cache.org/Advisories/

• Advisories: http://twiki.org/cgi-bin/view/Codev/TWikiSecurityAlerts

• Security contact: security [at] typo3 [dot] org
• Advisories: http://typo3.org/teams/security/security-bulletins/

• Unzip developers can be reached privately via http://www.info-zip.org/zip-bug.html

• Advisories and contact information: http://www.wireshark.org/security/

• Private security notification list: security (at) xen (dot) org
• Previous security announcements
• Security Problem Response Process

• Advisories: http://xinehq.de/index.php/security

• Security contact: xorg [dash] security [at] lists [dot] x [dot] org
• Updates information: http://wiki.x.org/wiki/Development/Security

There are separate wiki pages with similar information on distribution vendors and the infrastructure.

OSVDB maintains The Vendor Dictionary, an extensive database of software and appliance vendors (not limited to Open Source ones).