Some projects are friendlier than others.

If you are running a plain distribution, report it to the distribution. They will send them upstream.

XFree86 don't want bugs against X installations more than six months old.

mplayer don't want bugs against anything other than current CVS.

If you think it's a security bug there are often special arrangements for this.

But do file it somewhere.