Comment by md-

a software vulnerability itself is information about a vulnerability. Information itself is not copyrighted, nobody can own it.

A researcher however can own code he/her wrote, e.g. exploit code