Found independently by several entities and reported to the manufacturer before public disclosure; the CVE is typically attributed to the entity that reported it first.