We support the current minor version in regards to security updates. Versions are formatted <major>.<minor>.<patch>. So, for example 3.12.0 is the current version any security updates would be made in 3.12.1 or 3.13.0.
If this is a critical vulnerability that you would like to report confidentially, email the Eclipse Foundation Security Team:
Their vulnerability reporting process is described at https://www.eclipse.org/security/.