Please do not open a public issue for security problems.

Use GitHub's private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability. If that option is not available on a repository, open an issue asking for a private contact method, without including any details of the vulnerability.

You can expect an acknowledgement within a week. These are personal projects maintained in spare time, so fixes are best effort.

Only the latest release (or the default branch, for projects without releases) receives fixes.