As you suspect, this is an issue of terminology. You're probably looking for lists of vulnerabilities, but to be safe I'd like to explain a little bit more.
I'm afraid the whole thing is rather complicated, but worth it in the end!
Before I begin, I should point out there are many different approaches to Information Security that may have their own terminology (I'm an ISO 27000 man myself.) So other answers may use different wording.
So, you have your system that you are working on, and you want to protect it from harm - that's what Information Security is, the systematic protection of information from harm.
For harm to happen, there have to be two things. A "threat", which is someone who will cause harm (either deliberately or by accident), and a "vulnerability" which is a way that the threat can do harm.
Your competitor ("threat") accesses your system via SQL injection ("vulnerability") in order to steal your customer list ("harm" - specifically a "loss of confidentiality")
Joe in shipping ("threat") can't figure out how your system works ("vulnerability") and always puts in the wrong value for widget crank setting. ("harm" - specifically "loss of integrity").
You can find lists of threats and lists of vulnerabilities online.
Threats tend to be easier to figure out yourself though - who might realistically want to harm your system? Who might accidentally harm your system?
So mostly you find lists of vulnerabilities. The OWASP top ten is a great place to start.
Where does risk come into this, then? Risk is a measurement that combines the likelihood of a threat exploiting a vulnerability with the harm that would come about if they did.
Risk assessment is used to figure out which threat and vulnerability combinations have a risk higher than you want to accept, so you know that you need to "treat" them - do something about them.
For example, if your competitors are all honest, and you are carefully handling your SQL input, and everyone knows who your customers are anyway, then the risk in example one is very low and so not worth worrying about. (Well, not worth spending money on, at least.)
Alternatively, if Joe is careless and the wrong widget crank setting will make your product catch fire, then the risk is high, and you need to do something about Example 2 ASAP.
Here's the thing though - each risk assessment is pretty much unique because the threats and vulnerabilities you face are in a unique combination. Something like the OWASP list is not a short-cut. It's more a list of things you should check to make sure you haven't missed any of them.