Check if the vendor has a responsible disclosure program. Otherwise, try to contact them providing all the details. If you don't get any response after a while

Check if the vendor has a responsible disclosure program. Otherwise, try to contact them providing all the details. If you don't get any response after a while (2 months) you can make it public. Another way may be to contact your national CERT and inform them about the issue