Vulnerability
ELI5 — The Vibe Check
A vulnerability is a weakness in your code or system that a bad guy could exploit. Like a broken lock on a door. The lock exists, but it doesn't work properly, so anyone who knows the trick can get through. Vulnerabilities can be in your code, your libraries, your server config, or anywhere in the chain.
Real Talk
A vulnerability is a flaw or weakness in a system's design, implementation, or operation that can be exploited to violate security policies. Vulnerabilities are assigned CVE (Common Vulnerabilities and Exposures) identifiers and CVSS severity scores for tracking and prioritization.
When You'll Hear This
"A critical vulnerability was found in the auth module." / "The npm audit report shows 3 high-severity vulnerabilities."
Related Terms
Bug Bounty
A bug bounty program pays ethical hackers to find security vulnerabilities in your product.
Exploit
An exploit is the actual tool or technique used to take advantage of a vulnerability.
OWASP Top 10
The OWASP Top 10 is the security industry's greatest hits of web vulnerabilities — the 10 most common, dangerous ways apps get hacked.
Patch
A patch is a small update that fixes something specific without replacing the whole program.
Penetration Testing
Penetration testing (pentesting) is hiring ethical hackers to try to break into your own systems before the real bad guys do.
Zero-Day
A zero-day is a vulnerability that nobody knows about yet — except the person who found it. The name means the vendor has had 'zero days' to fix it.