What type of attack against a web application uses a newly discovered vulnerability that is not patchable?

Cross$-$site scripting $($XSS$)$

Zero$-$day attack

Structured Query Language $($SQL$)$ injection

Cross$-$site request forgery $($CSRF$)$