When vendors are that annoying I usually just go full disclosure.

I found some privilege escalations on some small cloud providers though that went as far as ignoring my mails to their listed security@.... e-mail, or yeah, not having a contact listed at all.

Not quite sure what to do with those. Posting these to a full-disclosure list? They're too small nobody's going to care, until someone does and steals customer data. Might as well just ignore it until someone else discovers it and steals customer data?