Low Severity
CVE-2026-46300
Published: Nov 4, 2026
Match CISA-exploited CVEs, via Lattice, against what is installed on this host. Prints evidence for a person to read.
# lattice-scan
Looks up CVEs that CISA lists as exploited, through the Lattice MCP server, and compares each with what is installed on **this** machine: packages,
snaps, running container images, the kernel. It prints the evidence, including installed version, CISA's dates and required action, and NVD's affected
version ranges. A person reads it and decides. It does not detect incidents or decide whether the host is affected, and it never closes a finding by itself.
Standard library only. Python 3.9 or newer.
## Install
```bash
pipx install lattice-scan # or: pip install lattice-scan
```
On Debian and Ubuntu, from the signed apt repository:
```bash
sudo curl -fsSL https://namiq.io/apt/lattice-scan.gpg -o /usr/share/keyrings/lattice-scan.gpg
echo "deb [signed-by=/usr/share/keyrings/lattice-scan.gpg] https://namiq.io/apt stable main" | sudo tee /etc/apt/sources.list.d/lattice-scan.list
sudo apt update && sudo apt install lattice-scan
```
The signing key's fingerprint is `C473 6154 4115 8A3E 775C 2EC2 7E61 15F4 0A41 061D`. Check it against the key you downloaded
(`gpg --show-keys /usr/share/keyrings/lattice-scan.gpg`). It is also published at https://namiq.io/lattice/docs, apart from the repository.
Or take the single-file `lattice-scan.pyz` or the `.deb` from the [releases page](https://github.com/namiq-ai/lattice-scan/releases) and check it with
`sha256sum -c SHA256SUMS`: `python3 lattice-scan.pyz --cve CVE-...`.
## Use
```bash
lattice-scan --cve CVE-2021-44228 --cve CVE-2026-46300 # works without a key
LATTICE_API_KEY=... lattice-scan --discover # a key lists what was added in the last week
lattice-scan # no arguments: the same as `recent --daily`
lattice-scan recent # no CVE id? read namiq.io's weekly list of recent exploited/critical CVEs; only likely matches go to Lattice (--daily: last day or two; --open: older ones, overdue first)