It's a good idea.
Generally the rule is 'tailor your CV to the job'. Meaning that you highlight any accomplishments and skills that make you a good fit for the job that needs to be done.
However, for a graduate you can be a bit more general - the employer appreciates that you don't have work experience, and are more looking to see that overall - you're motivated, on to it, can learn on the job, and are going to be good cultural fit. On this theme, that you've discovered exploits demonstrates that you go above and beyond.
With exploits - yes, there's the concern that the potential employer is going to think, 'Exploits?! This guy is going to be some anarchistic troublemaker!'. And to be fair, that might be a legitimate concern.
On the other hand, an employer might think 'Oh great, this guy is conscientious and thorough, thinks outside the box, he's be a valuable addition to the team'.
Potentially - there will be employers who don't want this, 'We don't someone who's going to be all thinking about security and holding things up, just get the job done!'.
The question you need to ask yourself is, what kind of employer do you want to work for? Do you want to work for an employer that appreciates exploit discovery? If so, put it on your CV, because it can only help you find the job that will fit you.
Especially if the jobs you're going for are in web development, there's probably not many employers who wouldn't want employees who are thinking about exploits.