When I find a vulnerability for a product that is not handled by a CNA (CVE Number Author, I apply for a CVE before notifying the vendor.

> CVE Numbering Authorities (CNAs) are organizations from around the
> world that are authorized to assign CVEs to vulnerabilities affecting
> products within their distinct, agreed-upon scope, for inclusion in
> first-time public announcements of new vulnerabilities. These CVEs are
> provided to researchers, vulnerability disclosers, and information
> technology vendors. -- https://cve.mitre.org/cve/cna.html

My reason to do it this way, is that now I can ask the vendor to make reference to the CVE in the security advisory/release note. And in turn, the CVE can now make a direct reference to the vendors security advisory/release note.

I also believe that the vendor will feel more pressed to patch the product when a CVE already have been assigned.

For the second question, I do not believe the confirmation has to come from the vendor in question. If that was the case, one would not be able to issue a CVE for products that are no longer maintained.

Remember, the purpose of a CVE is to uniquely identify a specific vulnerability. Imagine how two different vulnerability scanners would identify the same vulnerability if there was no common reference for it.

So any published material that describe or confirm a vulnerability could be used.

As @SmokeDispenser says, a github repo would suffice. Another appropriate place to publish vulnerabilities is http://seclists.org/fulldisclosure/, as it read by many in the security field.