An attacker finds and exploits a flaw unknown to the vendor; the exploit works until it is detected and patched.
An unknown vulnerability without an available patch lets attackers strike before defenders can respond.
