LTS versions are supported for 6 months after a new version is released, Normal versions are supported for only 1 month, and the Beta versions are supported for 2 weeks.

You can report vulnerabilities by creating an issue (if a solution is not found yet), or creating a pull request (if you have created and tested the code)

If a vulnerability is declined, it most likely means that it is on a version that isn't supported, and was already fixed, or the vulnerability isn't easy to fix.

If the vulnerability is accepted, you can expect a hotfix to come out in 1-2 days, depending on my availability.