CB 1.9.1 is not maintained anymore and we do not make security statements on unmaintained releases.
There has been no security-release since then, but given that CB 2.0 is a new code base, it doesn't tell anything for CB 1.9.1.
I don't recall any known high- or medium-level security issue in CB 1.9.1 at the present time, but that statement is only valid at the present minute.
The upgrade from CB 1.9.1 to CB 2.0 is straight forward (unless you changed (aka hacked) the CB code), and CBSubs 3.latest is compatible with CB 2.0. And it is a recommended upgrade all cases, including when only using CB, because of many reasons, one being that you can react quicker in case of a critical release, another one being that you get mobile layouts (mobiles are over half of surfing nowadays), and many more.