How do I tell what security issues require upgrade?
I'm guessing the advisory will be posted any moment, but you should be able to go to 4.6.12 instead of jumping to 4.7. I believe the 4.6.x branch is now a LTS branch so you don't need to go to 4.7 immediately.
Update: The advisories have been updated (shortly after I posted) and also an email has been sent to the security list (subscribe here):

This is a notification of a security release for CiviCRM. We recommend
you immediately upgrade to a secure version of CiviCRM.
The most recent releases are CiviCRM 4.7.1 or CiviCRM 4.6.12. 4.4.21
LTS has been released also.
Some fixes affecting security were included in CiviCRM 4.6.10 and
4.6.11, but the email announcements which should accompany such releases was omitted. So, we're releasing 4.6.12 to time with a
security release window and ensure subscribers get notified.
Read the security advisories for details of the various fixes included
in the latest CiviCRM builds:

https://civicrm.org/advisory/civi-sa-2015-010-version-information-disclosure
https://civicrm.org/advisory/civi-sa-2015-011-reflected-xss-in-error-message
https://civicrm.org/advisory/civi-sa-2016-01-path-disclosure
https://civicrm.org/advisory/civi-sa-2016-02-access-bypass
https://civicrm.org/advisory/civi-sa-2016-03-multiple-vulnerabilties-in-dompdf

A number of other non-security issues have also been fixed in the
latest releases. Upgrade now for the most stable CiviCRM experience.
CiviCRM security announcements are available from
https://civicrm.org/advisory and via the CiviCRM Security
Notifications email list.
CiviCRM.org, San Francisco, CA 94117 United States