Also, you don't need to issue a CVE to publish a vulnerability. You just make it public regardless and say CVE was denied for it.