Only the last major release is supported. Before reporting an issue you should always make sure you are running the latest release.
For non-critical vulnerabilities, just open an issue.
For very sensitive issues you can report privately in the Security tab.