Only the latest release of Waku receives security fixes. Updates ship through the in-app updater and https://waku.sh.
Please use GitHub private vulnerability reporting: https://github.com/egoist/waku/security/advisories/new
If that doesn't work for you, email [email protected].
Please don't open a public issue for anything you believe is exploitable before it has been fixed. Include reproduction steps and the Waku version (Waku → About Waku) you tested.