Only the last major release is supported. Before reporting an issue you should always make sure you are running the latest release.

For non-critical vulnerabilities, just open an issue.

For very sensitive issues you can report privately in the Security tab.