I guess it's true that most vulns are either reported to (or originate from) a vendor, and that these dominate the CVE db. But naturally, unless you are the ve

I guess it's true that most vulns are either reported to (or originate from) a vendor, and that these dominate the CVE db. But naturally, unless you are the vendor, you will likely not have heard of these. Otherwise, by definition, they would be zero-day vulns.