Risk refers to the combination of threat probability and loss/impact. For example, if you have an SQL injection vulnerability there is a threat of sensitive data theft. The potential impact is significant financial and reputation loss, and the probability of an attack is high. Therefore, this is a high-risk situation.
See how an SQL injection may lead to complete system compromise.