This is the point of responsible disclosure. Tell the company, wait a week or whatever, if they do nothing, then it's ethnical for you to tell the world.