Please see our release roadmap on https://www.neos.io/features/release-process.html for an overview of which versions are still being supported fully, with security fixes only or no longer at all.
A list of security bulletins we released can be found on https://www.neos.io/community/security-bulletins.html
If you discover a security issue with Neos, Flow or a related package, please contact us via security@neos.io instead of using a public channel. That way we can work on a fix together before everyone knows how to exploit a potential issue. Thank you!