Only the latest release gets fixes.

Report it privately through GitHub Security Advisories, not in a public issue.

You'll get an acknowledgement within a week. If the report is confirmed, a fix ships in a new release and the advisory is published with credit, unless you'd rather stay anonymous.

Common Stats runs unprivileged and makes no network connections, so the most likely issues are in how it parses kernel and IOKit data. Reports about those are welcome too.