I believe I have found some security vulnerabilities in a popular open-source desktop application, and have contacted one of the application's project organisers via their website. I got in touch mid-March, and got a response three weeks later, saying that it would be fixed. I sent a polite chase a couple of weeks later for a progress report, and after another two weeks, I've heard nothing.
I'm in no personal rush to have this fixed, and since it has probably been around for years, a couple of months here and there is probably not worth worrying about. But from a responsible reporting perspective, is there a website/organisation it can be elevated to? It is at least a mid-level risk, in my view.
(Aside: since the vulnerabilities are of a technical nature, I wondered whether this would be best on Programmers. However, since it is not a programming question per se, on balance I thought it would be more appropriate here).
Addendum, for interest. Following several months of sporadic discussion with the core devs, the bug is still not fixed, so I've released a note about the vulnerability into the public domain.