You can report Ubuntu vulnerabilities at Ubuntu. Although you can report XianZaiOS specific vulnerabilities in the Issues tab

Your reports can get updated in under one month or over. If the vulnerability has been accepted, a new patch (https://envipatch.weebly.com) will be created that you can then install. Although if it has been declined, the Issue will be closed.