> Nowadays a 0-day basically means the person who found it decided to exploit it instead of report it. So the company finds out because there is an active explo

> Nowadays a 0-day basically means the person who found it decided to exploit it instead of report it. So the company finds out because there is an active exploit instead of having it responsibly reported. Any vulnerability that was reported and not fixed could probably be considered one? Or any unfixed one for that matter (any widely exploitable vulnerability).