What happens when a security researcher discovers and reports a new vulnerability? A$.$ the vulnerability is assigned a candidate number and published as an entry in the CVE list b$.$ The vulnerability is published in the CVE list until members of the CVE editorial board decide if accepting or rejecting it C$.$ The vulnerability is published in the CVE list until peer security researchers decide if accepting or rejecting it D$.$ the vulnerability remains as a candidate until further review is performed