From 87ee896bdb75a74c55cbda52ac3004e3d492b56e Mon Sep 17 00:00:00 2001
From: Luke Heath <luke@fleetdm.com>
Date: Thu, 11 Jun 2026 17:36:00 -0500
Subject: [PATCH] Website: Add dashboard vulnerability exposure article
 (#46485)

---
 articles/dashboard-vulnerability-exposure.md | 33 ++++++++++++++++++++
 website/config/routes.js                     |  2 +-
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 articles/dashboard-vulnerability-exposure.md

diff --git a/articles/dashboard-vulnerability-exposure.md b/articles/dashboard-vulnerability-exposure.md
new file mode 100644
index 0000000000..34de8c2816
--- /dev/null
+++ b/articles/dashboard-vulnerability-exposure.md
@@ -0,0 +1,33 @@
+# Dashboard vulnerability exposure
+
+Fleet's dashboard includes a "Vulnerability exposure" chart that shows how many hosts have critical CVEs in a curated set of widely deployed software.
+
+For the full list of software Fleet detects vulnerabilities on, see [Vulnerability processing](https://fleetdm.com/articles/vulnerability-processing).
+
+## What's included in the chart
+
+| Category | Software |
+|----------|----------|
+| Browsers | Google Chrome, Mozilla Firefox, Brave, Safari, Opera |
+| Microsoft Office | Word, Excel, PowerPoint, Outlook, and standalone Office installs |
+| Adobe | Acrobat, Flash, Shockwave Flash |
+| Linux kernel | `linux-image` and `linux-signed-image` packages on Debian and Ubuntu; `kernel-*` packages on RHEL, Fedora, and Amazon Linux |
+
+Patterns cover packaging variants, so Chrome Beta and Canary, Firefox ESR and Nightly, and kernel metapackages are picked up without extra configuration.
+
+## Why not every software item
+
+Two things shape what the chart counts.
+
+**Reach and risk.** The chart is meant to be a single, quick read on the worst exposure across your fleet. Browsers, Office, and the Linux kernel are the software where critical CVEs most often turn into real exploits, and they are the software most hosts run. Adobe is included for the same reason. PDF and document handlers remain a common foothold.
+
+**Performance.** Each tracked CVE is stored as a per-host bitmap to keep dashboard rendering fast on large deployments. Expanding the list past the curated set is not free in storage or query time. Bitmap compression and per-user filtering are on the roadmap (see [issue #44746](https://github.com/fleetdm/fleet/issues/44746)).
+
+For everything else (Python, Homebrew, npm, Chocolatey, browser extensions, IDE extensions, full OS packages, and more), open **Software > Vulnerabilities** or filter the host list by CVE.
+
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="lukeheath">
+<meta name="authorFullName" value="Luke Heath">
+<meta name="publishedOn" value="2026-05-29">
+<meta name="articleTitle" value="Dashboard vulnerability exposure">
+<meta name="description" value="Which software the dashboard's Vulnerability exposure chart reports on and why.">
diff --git a/website/config/routes.js b/website/config/routes.js
index c89cc233a1..9ba512aa89 100644
--- a/website/config/routes.js
+++ b/website/config/routes.js
@@ -1365,7 +1365,7 @@ module.exports.routes = {
   'GET /learn-more-about/deploy-fleet': '/docs/deploy/deploy-fleet',
   'GET /learn-more-about/fleet-variables': '/guides/fleet-variables',
   'GET /learn-more-about/fleets': '/guides/fleets',
-  'GET /learn-more-about/vulnerability-exposure-cves': 'https://github.com/fleetdm/fleet/blob/1ea1fddfd62f66fd14de65cbeceb4f7a9d0167ec/server/chart/internal/mysql/charts.go#L111-L138',
+  'GET /learn-more-about/vulnerability-exposure-cves': '/articles/dashboard-vulnerability-exposure',
   'GET /learn-more-about/linux-wipe': '/guides/lock-wipe-hosts#linux-wipe-behavior',
 
   // Sitemap