oh by all means email them all directly saying you found a vulnerability.

im sure for 15,579 websites there will only be about 2500 of them that send the cops after you for "hacking their site", manageable