You can keep them for yourself (can make further research easier), release them as 0days (not every vulnerability can be used by attackers so sometimes full dis

You can keep them for yourself (can make further research easier), release them as 0days (not every vulnerability can be used by attackers so sometimes full disclosure isn't a bad idea. an example would be bootchain bugs, they can't be used remotely), release them as jailbreaks, sell them to someone (you can verify they won't be used for malicious purposes; you could sell them to another researcher for example which can use them to make their research easier)