Low Severity
Published: Nov 7, 2026
Match CISA-exploited CVEs, via Lattice, against what is installed on this host. Prints evidence for a person to read.
# lattice-scan
Looks up CVEs that CISA lists as exploited, through the Lattice MCP server, and compares each with what is installed on **this** machine: packages,
snaps, the hardware, the running container images and what is inside them (all local images with `--deep`), the kernel. It prints the evidence, including installed version, CISA's dates and required action, and NVD's affected
version ranges. A person reads it and decides. It does not detect incidents or decide whether the host is affected, and it never closes a finding by itself.
`lattice-scan posture` also shows what the host exposes and runs: listening ports, firewall, SSH settings, services and processes that no package owns.
Standard library only: no runtime dependency. Python 3.9 or newer. [Self-audit](https://github.com/namiq-ai/lattice-scan/blob/main/docs/SELF-AUDIT.md).
## Install
```bash
pipx install lattice-scan # or: pip install lattice-scan
```
On Debian and Ubuntu, from the signed apt repository:
```bash
sudo curl -fsSL https://namiq.io/apt/lattice-scan.gpg -o /usr/share/keyrings/lattice-scan.gpg
echo "deb [signed-by=/usr/share/keyrings/lattice-scan.gpg] https://namiq.io/apt stable main" | sudo tee /etc/apt/sources.list.d/lattice-scan.list
sudo apt update && sudo apt install lattice-scan
```
The signing key's fingerprint is `C473 6154 4115 8A3E 775C 2EC2 7E61 15F4 0A41 061D`. Check it against the key you downloaded
(`gpg --show-keys /usr/share/keyrings/lattice-scan.gpg`). It is also published at https://namiq.io/lattice/docs, apart from the repository.
Or take the single-file `lattice-scan.pyz` or the `.deb` from the [releases page](https://github.com/namiq-ai/lattice-scan/releases) and check it with
`sha256sum -c SHA256SUMS`: `python3 lattice-scan.pyz --cve CVE-...`.
## What it does
| You want to | Run | It reads | What leaves the machine |
|---|---|---|---|
| Check a CVE you know of | `lattice-scan --cve CVE-...` | this host's inventory, locally | the CVE id |
|