i would contact the local entity that is responsible for cybersecurity, like the bsi in germany or as an second option an ngo that cares about security. The later can also publish it themself or helping to publish it without legal problems