I remember waiting to report a security issue with some trivial setuid application until January, back a few years, specifically so I could claim the first CVE of the year.

I was unlucky and it didn't work out, but come December time I do wonder if I should dedicate more time to audits ..