Any security vulnerability can be reported at the project JIRA. When creating the issue, there is a special tick box to mark the issue as security sensitive so make sure to select it:

• This issue is security relevant