Comment by theteapot

Not sure that contradicts the claim. Publishing the CVE is what makes it public.