In more detail
A vulnerability is a weakness in software, hardware or a process that an attacker could use to cause harm. Vulnerabilities come from coding mistakes, bad configuration or design flaws. Publicly known ones get a CVE identifier and a CVSS severity score, and are fixed by patches. The risk depends on how easy the flaw is to exploit, whether it is exposed and what it would give an attacker. A vulnerability is only the weakness: the code or technique that takes advantage of it is an exploit, and the person or group is the threat.
Why it matters
Most successful attacks use known flaws for which a patch already existed, so knowing what you run and applying updates removes the majority of risk. Severity scores help to prioritise, but a "critical" flaw in a system nobody can reach matters less than a medium one on an internet-facing server. Flaws with no fix yet are called a Zero-day. See CVSS Metrics Cheat Sheet.
Example
Log4Shell, tracked as CVE-2021-44228, was a flaw in the Apache Log4j 2 logging library that let a crafted text string cause the server to load and run remote code. Its vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (reachable over the network, low complexity, no privileges, no user action, scope changed, high impact on confidentiality, integrity and availability) computes to a CVSS 3.1 base score of 10.0, the maximum. The CVSS calculator reproduces that score from the metrics.
Common confusion
A vulnerability is not an attack or a breach. It is a weakness that may or may not ever be used. An exploit is the means of using it, and a threat is who might do so.