This page lists security contacts, bug tracker links, links to advisories, etc. for various open source-providing vendors, such as distributors of Linux, *BSD, and other related operating systems.

When adding to this page, please include the following vendor information:

1. link to bug tracker (i.e. Bugzilla)
2. link to security advisories, errata, or any other page that provides notification of security-related updates/changes
3. email address for the security contact

As well, please keep this list in alphabetical order.

• Security bulletins: Amazon Linux AMI Security Center (RSS feed)
• Security contact: aws [dash] security [at] amazon [dot] com PGP key
• AWS Security Center
• Vulnerability reporting information

• Security process information
• Security issues should be sent to product [dash] security [at] apple [dot] com
• Alternatively, reported through the Apple Bug Reporter
• Security advisories

• Arch Linux bug tracker (public issues)
• Security issues should be sent to security [at] archlinux [dot] org

• Debian bug tracker (public issues only), Security issue tracker (public issues only)
• Security issues should be sent to security [at] debian [dot] org
• Recent advisories are listed upon our front page

• DragonFly Security Officer: security [at] dragonflybsd [dot] org (PGP key)

• The process for receiving security advisories requires a Support or Maintenance subscription
• Bug tracking database - access requires a Support or Maintenance subscription
• Enea Security: http://www.enea.com/solutions/Enea-Linux/Security
• Enea security contacts can be reached at security [at] enea [dot] com

• How and where to report a FreeBSD security issue
  • All FreeBSD security issues should be reported to the FreeBSD Security Team at secteam [at] FreeBSD [dot] org
  • For a higher level of confidentiality, PGP-encrypted e-mail may be sent to the Security Officer Team at security [dash] officer [at] FreeBSD [dot] org (PGP key)

• Security issues should be sent to frugalware [dash] security [dash] private [at] frugalware [dot] org
• Advisories are published for the stable branch at the Frugalware Security mailing list

• Gentoo Bugzilla – see “Gentoo Security” product.
• Gentoo Linux Security Advisories (GLSA) published via Mail (subscribe), HTTP and Feeds.
• Security Website with Vulnerability Policy and confidential contacts.
• Security contact: security [at] gentoo [dot] org, #gentoo-security on irc.freenode.net.

• Homebrew issue tracker
• Security contact: security [at] brew [dot] sh

• How and where to report an IBM Product Security Incident
• Security Bulletins
• IBM Customer Support Portal
• IBM Product Security Incident Support Team (PSIRT): psirt [at] us [dot] ibm [dot] com PGP key

• Mageia Bugzilla
• Security and bugfix information)
• Security contact: security [at] mageia [dot] org

• Report security issues through the Microsoft Security Response Center
• Details on the reporting procedure are available here
• Information about the bounty program here

• The process for receiving security advisories requires a Support or Maintenance subscription.
• Bug tracking database - access requires a Support or Maintenance subscription.
• Security Advisories
• MontaVista security contacts can be reached at security [at] mvista [dot] com PGP key

• Bug tracking database
• Contact and errata information
• Security contact: security [dash] alert [at] NetBSD [dot] org
• (for pkgsrc please see separate entry below)

• Bug tracking mailing list: bugs [at] openbsd [dot] org (Archive, Subscribe)
• Security and errata information
• Security contact: deraadt [at] openbsd [dot] org

• Bugzilla
• Security-support page
• SUSE Security Announcements RSS feed
• Mailing-list: opensuse-security-announce and opensuse-security
• Security contact: security [at] suse [dot] de

• Changes in the currently-maintained stable branch (any security fixes are marked as such, along with issue severity information)
• Changes in the development branch (ditto)
• Security contact: security [at] owl [dot] openwall [dot] com

• Oracle Bugzilla
• Oracle Linux Erratas includes security advisories
• Security contact information - email for reporting vulnerabilities: secalert_us [at] oracle [dot] com
• Oracle Linux introduction, downloads, support offerings
• Oracle security fix policy

• Update announcements published via Parallels KnowledgeBase and Parallels Cloud Server RSS, Parallels Containers for Linux RSS.
• Security contact: security [at] parallels [dot] com

• For issues in NetBSD please see the separate entry
• Bug tracking database – select 'pkg' Category
• Vulnerable package versions database
• Security contact: pkgsrc [dash] security [at] NetBSD [dot] org
• PGP key

• Qlustar Security Advisories (QSA) Archive (subscribe).
• Security contact: security [at] qlustar [dot] com

• Report security issues to secalert [at] redhat [dot] com or see https://www.redhat.com/security/team/contact/ for our keys and policies
• Advisories for all Red Hat products are published to the RHSA announce mailing list since Nov 2007 (older are at http://www.redhat.com/archives/enterprise-watch-list/).

• Oracle Critical Patch Updates and Security Alerts
• Security contact information - email for reporting vulnerabilities: secalert_us [at] oracle [dot] com
• Oracle security fix policy
• Changes in security policies for the Sun product lines

• Use https://gitlab.labs.nic.cz/turris/openwrt/issues to report TurrisOS bugs (private security bugs can be opened by checking the “This issue is confidential and should only be visible to team members with at least Reporter access.” box).
• Security contacts for TurrisOS can be reached at security [at] turris [dot] cz.

• Use Launchpad to report Ubuntu bugs
  • Private security bugs can be opened by selecting the “Private Security” option in the “This bug contains information that is:” drop-down menu
• Ubuntu Security Notices are sent to the ubuntu-security-announce mailing list
• Security contacts for Ubuntu can be reached at security [at] ubuntu [dot] com or see the Ubuntu Security FAQ for more information

• VMware Security Advisories (VMSAs) are posted to http://www.vmware.com/security/advisories.
• You can sign up for receiving security advisories at http://www.vmware.com/security.
• Report security issues to security [at] vmware [dot] com or see the VMware Security Response Policy for more information.

• The process for receiving security advisories requires a Support or Maintenance subscription. https://support.windriver.com/olsPortal/faces/basic/portal.jspx
• Info on what Wind River publicly disclose and what they don't; RSS feeds with the publicly disclosed info on security issues
• Wind River Linux security contacts can be reached at security [dash] alert [at] windriver [dot] com.

There are separate wiki pages with similar information on individual Open Source projects and the infrastructure.

There's a similar page on the Distributions Wiki.