[internet_arguer]

The culture of different government agencies varies widely. US-CERT is run by Carnegie Mellon University. US-CERT, incidentally is far older than the relatively new DHS. US-CERT, Mitre, and the rest are all about transparency and don't have motivation to hold onto really effective exploits.

However, if NSA discovers a ground-breaking exploit, and it's deemed low-risk to US systems, they'll probably keep it. But they certainly wouldn't disclose it to US-CERT or Mitre. Not to mention, since US-CERT and Mitre aren't in the intelligence community, they don't have a mechanism to keep information like that undisclosed.