CVE disclosure list: oss-security@lists.openwall.com (unfortunately since Mitre stopped taking bug reports via e-mails it's not as active as it has been).