...where to report this. Internally, where, in my case, it would get higher visibility and more likely to be fixed in a timely manner, or externally so that others that may be affected would see the problem was already reported?

Why not report both internally and externally? That way, everyone affected would be informed, chances of getting it fixed in a timely manner wouldn't be worse than when reporting either internally or externally alone, and once the issue is fixed, you could simply update/close the bug report in both places...  Or have I misunderstood something?