Well, as always, the answer is "it depends".
It isn't illegal per se.
If both parties agree, it's good business. You get paid for the work of compiling the report. For example, let's say you leave and are no longer working for them, and they call you and say "hey, you know those security vulnerabilities you were talking about last year? Yeah, the boss finally decided to give it priority, but it seems we kept no notes in that meeting. Could you compile a report for us? I know you no longer work here, but we would pay you a little more than the normal contractor rate if you are interested". That's perfectly fine.
Now, not disclosing them when you found them could be seen as a breach of contract, which implicitely includes the duty of loyalty. Keeping it a secret to cash in on later is certainly sleazy.
The compiled report might, depending on state laws, your specific contract, and who can pay the better lawyer, end up as their's. You can only compile that report because you worked there and you got knowledge of those vulnerabilites only as a part of your job.
And finally, even if you did compile a report and it is waterproof and it is yours exclusively, it very much depends on the "else". What if they just say "no thanks"? Selling that report to someone else is illegal. So you have exactly one legal buyer and that buyer knows it. Does not sound like a great bargaining position.
If you approach them, it takes a lot of skill and maybe a bit of legal training to make sure it does come across as an offer of "good business". I think it would be easy to be misinterpreted as either blackmail or selling them knowledge they legally probably already own.
So unless you are certain you can fit into that "good business" model of selling your work compiling a report, instead of selling the knowledge of their secrets, it might be safer to not do that.
If they approach you, it should not be a problem, but if you approach them, it will be a mess, no matter how well you mean it.