First, be sure that the vulnerabilty have been found on a supported version. A list of supported versions can be found in the next section.

If the vulnerability was found in a supported version, then report it as a bug. This may not be the best practice but, if people show interest in the product, I will make sure this is changed in the future.