A weakness in a system that could be exploited to compromise its confidentiality, integrity, or availability.
Not every vulnerability is equally dangerous — severity depends on exploitability and potential impact, which is exactly what CVSS scoring attempts to quantify.
