A vulnerability is a weakness: the lock on your back door is broken. Nothing bad has happened yet — but it could.
A threat is someone who might use it: the burglar walking through the neighbourhood, checking doors.
An exploit is actually using the weakness: the burglar finds the broken lock and walks in.
Risk is how likely multiplied by how bad. A broken lock on a garden shed is a small risk; the same lock on a bank vault is huge. Risk sets priority — and that is exactly how a good audit report ranks its findings.