A vulnerability is a known potential weakness in a system. A threat is someone telling you they’re going to exploit the known weakness.