Please nitpick the following (or suggest an authority, such as NIST or CISA )

A vulnerability is a weakness that can be exploited to gain some goal or milestone for an attacker, such as the ability to run code. Vulnerabilities are usually bugs which get patched, and weaknesses are a broader set that includes susceptibility to threats. Code which demonstrates that a vulnerability is exploitable is called “proof-of-concept” or PoC. A PoC may be developed into an exploit, which is code that actually achieves that goal. Weaponized exploit code has been made production-ready with reliability or integration into some attack framework. The attackers may be not be malicious, for example external researchers or penetration testers.