Medium Severity
Published: Oct 25, 2026
Find the CVEs that matter on a Linux box and its running containers. Reads the package lists already there, asks OSV.dev, ranks by CISA KEV and EPSS. No scanner binary, no database, no server.
# sieve
Find the CVEs that matter on a Linux box and its running containers, plus the weak passwords and plain-text secrets left lying around it.
[](https://github.com/casareanderson/sieve/actions/workflows/ci.yml)
[](LICENSE)
[](https://github.com/casareanderson/sieve/releases/latest)
No scanner binary, no 1.4 GB database, no server: sieve reads the package lists already on the box, asks
[OSV.dev](https://osv.dev) which advisories affect those exact versions, then ranks the results by
[CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) and [EPSS](https://www.first.org/epss/).
Its only dependency is `requests`.
## Contents
- [What it does](#what-it-does)
- [Screenshots and demo](#screenshots-and-demo)
- [Quick start](#quick-start)
- [Usage](#usage)
- [Configuration](#configuration)
- [How it works](#how-it-works)
- [Status and limits](#status-and-limits)
- [Benchmark](#benchmark)
- [Development](#development)
- [Licence and credits](#licence-and-credits)
## What it does
- Reads the package lists already on a machine — dpkg, apk or rpm, plus Python and npm packages outside the OS — and scans running containers through their real filesystem under `/proc`. No binary, no database to patch.
- Asks OSV.dev which advisories affect those exact versions, then ranks them so known-exploited (CISA KEV) and likely-exploited (EPSS) findings come first, and known-malicious packages above everything.
- Flags, per finding, whether the vulnerable code is loaded in a running process right now (`IN USE`), and checks that no installed file has been changed since its package manager put it there (`sieve verify`).
- Scans project dir