Identifying a framework or application-specific vulnerability, including Known Component Vulnerabilities (identified by their CVE designation, which we'll discuss later), is a tricky business.
It's a universal stipulation of bug bounty programs that companies don't reward the same vulnerability twice—the first researcher to disclose a vulnerability is the only one that's rewarded. This goes hand in hand with the fact that companies usually won't reward already publicly disclosed bugs within two weeks of the discovery of the original zero-day (like everyone, they need time to deploy a patch), and they aren't interested in vendor-level vulnerabilities in third-party libraries. This might seem like a waste of time, then, except if we take two important points into consideration.
The cost of adoption...