Security updates are only supported for the latest release. If you cannot upgrade due to using an older version of Home Assistant, then you should upgrade HA also, as that may also have vulnerabilities in older versions.

Please use the "Report a VUlnerability" button on the new Issue page to report vulnerabilities.

This will give the developers a heads up about the issue before posting publicly, to protect other users who may be affected. Security issues will be treated as top priority, so you should get a response within 72 hours, usually much sooner.