What about publicly posting that there is an X-level vulnerability and privately communicating what it is? Then people can make their decisions while still reducing the chance the vulnerability immediately becomes an exploit.