I don't understand your point. A published CVE is already public and thus there's nothing really to disclose?