Only the current version gets security fixes: the client served at https://web.telegram.org/k/, built from master.

Please do not open a public issue. Report it privately, through GitHub's private vulnerability reporting or by email to security@telegram.org.