Zero-day
Definition
Publicly unknown vulnerability with no patch available. The name comes from the vendor having 'zero days' to react before the first attack.
Zero-day exploited in-the-wild: the worst combo — someone is using it already and there's no way to mitigate with a patch. Defence relies on vendor workaround (disable feature, WAF rule, network rule) or accepting risk until the patch ships.
Market: zero-days sell for serious money. Zerodium paid up to $2.5M for zero-click iOS RCE. State-actor buyers (NSO Group, Candiru) or extended bug bounty programs (Google Project Zero, GitHub Security Lab).
Distinct from n-day (vulnerability already patched but used on unpatched systems) and from public proof-of-concept (PoC) that accelerates exploitation after the patch.