Contact the CERT, they can help you out with establishing a line of communication: https://www.kb.cert.org/vuls/report/

Do it anonymously, if you fear backlash.