Only the latest release gets security fixes. A fix ships as a new release, not as a patch to an older one.

Please do not open a public issue for a vulnerability. Report it privately through GitHub's private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability, or go straight to https://github.com/airiclenz/capcom/security/advisories/new.

Include the capcom version (capcom version), the operating system, the steps that reproduce the problem and what an attacker gains. The report and its discussion stay private until a release with the fix is out.