When I find a vulnerability for a product that is not handled by a CNA (CVE Number Author, I apply for a CVE before notifying the vendor.

> CVE Numbering Authorities (CNAs) are organizations from around the
> world that are authorized to assign CVEs to vulnerabilities affecting
> products within their distinct, agreed-upon scope, for inclusion in
> first-time public announcements of new vulnerabilities. These CVEs are
> provided to researchers, vulnerability disclosers, and information
> technology vendors. -- https://cve.mitre.org/cve/cna.html

My reasoning to do it this way, is that now I can ask the vendor to make reference to the CVE in the security advisory/release note. And in turn, the CVE can now make a direct reference to the vendors security advisory/release note.

For the second question, I do not believe the confirmation has to come from the vendor in question. If that was the case, one would not be able to issue a CVE for products that are no longer maintained.

Remember, the purpose of a CVE is to uniquely identify a specific vulnerability. Imagine how two different vulnerability scanners would identify the same vulnerability if there was no common reference for it.

So any published material that describe or confirm a vulnerability could be used, as long it is capable of providing enough details to uniquely identify it. In contrast, if a vendor acknowledges a vulnerability, it is beyond doubt that the vulnerability exists, without having providing intricate details that could put others in immidiate risk.