> No one may “collect, sell or publish information on network product security vulnerabilities,”

So you cannot even inform the general public that, for example, a widely used consumer product has a critical vulnerability?