diff --git a/docs/Using Fleet/Vulnerability-Processing.md b/docs/Using Fleet/Vulnerability-Processing.md
index 2e675e5735..10d88debed 100644
--- a/docs/Using Fleet/Vulnerability-Processing.md	
+++ b/docs/Using Fleet/Vulnerability-Processing.md	
@@ -20,14 +20,23 @@ Fleet detects vulnerabilities for these software types:
 | ------------------- | ------------------------------------------ | ------------------------------------------------ | ---------------- |
 | Apps                | ✅                                         | ✅                                               | ❌               |
 | Browser plugins     | Chrome extensions, Firefox extensions      | Chrome extensions, Firefox extensions            | ❌               |
-| Packages            | Python, Homebrew  | Python, Atom, Chocolatey | Packages defined in the [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json), except for vulnerabilities involving configuration files. Supported distributions: <ul><li>Ubuntu</li><li>RHEL based distros (Red Hat, CentOS, Fedora, and Amazon Linux)</li></ul> |
+| Packages            | Python, Homebrew  | Python, Atom, Chocolatey | Packages defined in the [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json), except for vulnerabilities involving configuration files. Supported distributions: <ul><li>Ubuntu</li><li>Debian</li><li>RHEL based distros (Red Hat, CentOS, Fedora, and Amazon Linux)</li></ul> |
 | IDE extensions      | VS Code extensions | VS Code extensions | VS Code extensions |
 
 As of right now, only app names with all ASCII characters are supported. Apps with names featuring non-ASCII characters, such as Cyrillic, will not generate matches.
 
 For Ubuntu Linux, kernel vulnerabilities with known variants (ie. `-generic`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD.
 
-### Advanced configuration
+## Sources
+
+Fleet combines multiple sources to get accurate and up-to-date CVE information:
+- [National Vulnerability Database](https://nvd.nist.gov/developers/vulnerabilities) CVE feeds
+- [VulnCheck](https://vulncheck.com/) CVE feeds
+- [Mac Office release notes](https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac) for Office for Mac
+- [Microsoft MSRC Security Bulletins](https://msrc.microsoft.com/update-guide) for Windows OS vulnerabilities
+- [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json) for Linux software
+
+## Advanced configuration
 
 Fleet runs vulnerability downloading and processing via internal scheduled cron job. This internal mechanism is very useful
 for frictionless deployments and is well suited for most use cases. However, in larger deployments,