What bug/time tracking software do you use ?

We use Flyspray, and it works fine--very lightweight and easy to install anywhere with PHP available (we use it because it integrates relatively easily with the rest of our site).

I've also used Trac and liked it even more. Roundup is also good, if you don't need all of the extra stuff trac provides (wiki, timeline, etc.). If trac hasn't fixed their horribly broken authentication yet, then that would be a strong argument against it, but I can't imagine that it hasn't been fixed by now.

We use JIRA from Atlassian and love it.

http://www.atlassian.com/jira

+1 for Jira.

The Confluence Wiki from Atlassian is also a very nice product.

http://stufftodo.dedasys.com

It's more of a task list/time tracker. It does the second about as well as is possible without a local client running and is alright at the first.

lighthouseapp.com looks like a good hosted solution