Cisco is now reporting some of their vulnerabilities not because they're upfront. They were pressured by their customers and the community to do so and they're also liable if they don't. As hinted, they don't report everything. There are what Cisco refers to "hidden" bugs and vulnerabilities for which they don't announce because they tend to be serious and will only do so if you keep pressuring them.