Usually, only the last minor Shlink version is supported. So if the last version is 5.2.2 and a bug is found, only 5.2.3 will be released. Bugs will usually not be backported to previous versions.
The only exception is when a major version has just been released and the security issue is critical enough. In that case, a patch for previous major version may also be released, but this will be decided on a case by case basis.
Do not report potential vulnerabilities as public issues. Instead, do it through https://github.com/shlinkio/shlink/security