Bugs are currently being posted and tracked at Launchpad. The previous trackers at SourceForge are still available for historical purposes, but do not submit new items there as they will probably not be seen.
The best way to submit patches is to create a Bazaar branch and publish it to Launchpad.
It is also recommended that you email a note about your branch or tracker submission to the mailman-developers mailing list, but don't rely on just the email to get the attention of the Mailman developers.
Please see the Mailman security page for instructions on reporting security related issues.