Information about supported Istio versions can be found on the Support Announcements page on Istio's website.
Instructions for reporting a vulnerability can be found on the Istio Security Vulnerabilities page. The Istio Product Security Working Group receives vulnerability and security issue reports, and the company affiliation of the members of the group can be found at Early Disclosure Membership.
Information about previous Istio vulnerabilities can be found on the Security Bulletins page.