The Cert-IST 2026 annual report on vulnerabilities and attacks in 2025 is now available (only in French for the moment).

Does Cert-IST have a vulnerability disclosure policy?

Yes. The disclosure policy is available in the "Presentation - Vulnerability disclosure Policy" section.