A weakness of an asset or control that can be exploited by one or more threats.
The differences between risk, threat and vulnerability – explained
6 threats to protect your IT security against
Cyber security risk assessment: How to do it