Presently the current main branch and most recent release (if any) should be supported.

You can submit a private vulnerablity report following the default directions on github