A vulnerable component is a software element, such as a library, SDK, framework, or package, that has a known weakness. The weakness may be a bug, outdated version, insecure configuration, or flaw in a nested dependency. Even if the main application looks safe, a vulnerable component can still expose it to compromise.
In cyber security, vulnerable components matter because attackers often target the easiest entry point in the software supply chain. A single exposed package can enable code execution, data theft, denial of service, or privilege escalation across many applications that reuse it. Defenders look for these components through software inventories, SBOMs, dependency scans, and patch management so they can identify where the risky code is used, prioritize fixes, and remove or update it before it is exploited.