Only the latest release gets fixes. Check that the problem is still there in it before you report.

Do not open a public issue. Report it privately on the Security tab: only the maintainer sees the report. Say what an attacker can do and how to reproduce it.

The fix is agreed on in the report. The advisory is published with the release that fixes it.