vulnerability
/ vul-ner-uh-BIL-i-tee /
A vulnerability is a flaw in software that an attacker can exploit to do something they shouldn't — read private data, take over an account, crash the system. It's an unlocked window in an otherwise solid house: harmless until someone notices it, dangerous the moment they do.
Vulnerabilities aren't usually put there on purpose; they slip in through honest mistakes — a missing check, an out-of-date library, an input nobody thought to clean. The whole security cycle is about finding them, reporting them quietly, and shipping a fix (a 'patch') before attackers find them first.
Big ones get a public ID — a CVE number — so the world can track them. The scary kind is a 'zero-day': a vulnerability attackers are already using before the maker even knows it exists, leaving zero days to prepare a defense.
CVE-2021-44228 "Log4Shell" severity: CRITICAL (10.0) fix: upgrade log4j to 2.17.0 or later
A real vulnerability, named and scored, with the patch that closes it.
A vulnerability is the weak spot; an 'exploit' is the actual tool or trick that abuses it. One is the unlocked window, the other is the burglar already climbing through.