Only the latest release gets security fixes.

Do not open a public issue. Use the private vulnerability reporting of GitHub: Report a vulnerability (Security > Report a vulnerability on the repository). Only the maintainer sees the report. The maintainer replies, fixes the problem, and publishes an advisory with the fix.