Vulnerability Management (VM) refers to a process that identifies an organization's vulnerabilities (Common Vulnerabilities and Exposures, CVEs) that could be exploited by attackers to compromise individual assets. Thus, vulnerability management follows the motto: Only those who know their weaknesses can protect themselves effectively.
Risk management, on the other hand, is used to understand and manage potential risks. Thus, a first step is to understand the risk potential of the affected assets and systems in order to identify potential vulnerabilities and threats and to implement appropriate measures.