Question: I noticed that there are a list of Platforms/Vendors for which a CVE can be applied for.

What happens if I find a CVE for a proprietary platform (that is commercially available), is there a way to get a CVE assigned for it?

Answer: 
Different vendors require different steps to be taken in order to get a CVE ID assigned for vulnerabilities.

If you check [the MITRE CVE ID Request page here](https://cve.mitre.org/cve/request_id.html) then you can follow the instructions to request an ID after locating the correct CVE Numbering Authority.

If the vendor is not specifically mentioned in any of the tables and a relevant CNA is not listed then you have to contact MITRE directly to request a CVE ID by [filling out the form here](https://cveform.mitre.org/).
I think the main thing here is to make sure you follow Responsible Disclosure:

From [wikipedia](https://en.wikipedia.org/wiki/Responsible_disclosure):

> 
> Responsible disclosure is a computer security term describing a vulnerability disclosure model. It is like full disclosure, with the addition that all stakeholders agree to allow a period of time for the vulnerability to be patched before publishing the details.
> 
> 
> 

If you just go and publish details of the vulnerability without giving the vendor enough time to put out a patch, you will actually be doing more damage than good because you will be enabling attackers to hack otherwise secure systems.

If this is your first time disclosing a vuln and it all seems a bit overwhelming then, as Ross Smith says, the MITRE organization than runs the CVE database can act as the mediator between you and the vendor.