For 5.4, recently, yes, since 5.4 is "security only" mode since 3 month ago. For others, not necessarily, since there are a lot of fixes and improvements. Look at CVEs in the changelogs[1], while understanding that CVEs sometimes are assigned for issues like "if you could run arbitrary PHP code, then you could run any code" which IMO is always the case since PHP is not a security sandbox. But if you do not have enough in-depth knowledge to assess CVEs, just CVE presence should be a good upper bound. Note also some security issues are in the modules that may not be even used by the particular server (fileinfo and EXIF modules provided a bunch of CVEs recently but not everybody uses them) or may not be used in a way that is exploitable (so, unserialize() CVEs are only an issue if you unserialize user-controlled data, which is not a best practice). This is not to say those are not security issue, but running PHP version with a CVE would not always make your server exploitable. That said, you should upgrade anyway.

[1] http://php.net/ChangeLog-5.php

PHP minor releases are bug and security fixes. But as long as the latest minor release fixed a vulnerability, in 99% of the cases, you can assume that all previous versions contain that vulnerability. (I know, I know, regressions do happen)