Glossary · Security

Vulnerability

A vulnerability is a weakness in software, hardware, configuration or process that an attacker could exploit to harm confidentiality, integrity or availability.

Updated October 6, 2026

A vulnerability is a flaw or weakness in a system, application, configuration or process that could be exploited to gain unauthorized access, steal data or disrupt service.

Why it matters

Most real-world compromises use known vulnerabilities for which fixes already exist. Organizations manage them by scanning, prioritizing by severity and exposure, and patching or mitigating. Severity is often rated with CVSS, but context matters: a flaw on an internet-facing server is more urgent than the same flaw on an isolated machine.

Example

A web app concatenates user input into a database query, creating a SQL injection vulnerability. A server running an old TLS configuration or exposing an admin panel with a default password is also a vulnerability, though not a code bug.

Common mistakes

  • Treating a vulnerability scan result as proof of a breach, or a clean scan as proof of safety.
  • Prioritizing only by CVSS score without considering exposure.
  • Ignoring misconfigurations, which cause many incidents.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityHSTS (HTTP Strict Transport Security)HSTS is a response header that tells browsers to use HTTPS only for your domain, blocking downgrade attacks and skipping insecure HTTP redirects.Glossary · SecurityMan-in-the-Middle Attack (MITM)A man-in-the-middle attack places an attacker between two parties so they can read or alter traffic that both sides believe is private.Glossary · SecurityMixed ContentMixed content is an HTTPS page that loads some resources, such as scripts or images, over plain HTTP, weakening or breaking its security.Guide · SSL & SecurityContent Security Policy (CSP) Guide: Directives, Nonces, RolloutBuild a Content Security Policy that works: key directives, nonces and strict-dynamic, Report-Only rollout, violation reports, and fixes for common breakage.7 min readGuide · SSL & SecurityCookie Flags Explained: Secure, HttpOnly and SameSiteWhat the Secure, HttpOnly, SameSite, Domain, Path and cookie prefix attributes do, how to set them in common stacks, and how to debug cookies that go missing.7 min readGuide · E-commerceE-commerce Site Security Checklist: 30 Checks for Online StoresA practical security checklist for online stores covering HTTPS, headers, payment pages, third-party scripts, admin access, updates, backups and monitoring.7 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.