A vulnerability tells you what is wrong. An exposure tells you what an attacker can actually use, and it changes when nothing in your code does.