Is there a reason why an organization would continue to use CVE numbers from last year?
However, a CNA like Firefox does not allocate CVE as they need them. They first ask Mitre for a block of X CVE to use as they need. They probably got a new block in September.