Only the latest version is supported. Spigot server types are not supported for good reason. If you're using (a fork) of Spigot which doesn't support the Paper API, support will not be provided, except for V13-S, should any contributor feel generous.
To report a vulnerability, please contact semmelbrot12 on her email ([email protected]), OR, raise the issue to any contributor.
If semmmelbrot12 is contacted directly you can expect a response anywhere from a few hours up to a day or two. If a contributor is made aware, works on security patches can begin faster, however, you may not get a response.