Mitnicks security company recently started a vulnerability marketplace. For vulnerabilities that meet the criteria (they have to be of a certain severity, not already known, etc), they are sold for a minimum of $100,000.