A vulnerability is a hole or a weakness in an application that allows an attacker to cause harm to the stakeholders of an application.
Hopefully, newly discovered vulnerabilities (also called "0-days"), are reported by ethical hackers, in a responsible way.