Low Severity
Published: Nov 12, 2026
Match CISA-exploited CVEs, via Lattice, against what is installed on this host. Prints evidence for a person to read.
# lattice-scan
Looks up CVEs that CISA lists as exploited, through the Lattice MCP server, and compares each with what is installed on **this** machine: packages,
snaps, the hardware, the running container images and what is inside them (all local images with `--deep`), the kernel. It prints the evidence, including installed version, CISA's dates and required action, and NVD's affected
version ranges. A person reads it and decides. It does not detect incidents or decide whether the host is affected, and it never closes a finding by itself.
`lattice-scan posture` also shows what the host exposes and runs: listening ports, firewall, SSH settings, services and processes that no package owns.
Standard library only: no runtime dependency. Python 3.9 or newer. [Self-audit](https://github.com/namiq-ai/lattice-scan/blob/main/docs/SELF-AUDIT.md).
## Install
```bash
pipx install lattice-scan # or: pip install lattice-scan
```
**Platforms.** Linux (Debian and Ubuntu are tested) and macOS 12 and later. On a Mac the tool reads the operating system version, the apps in /Applications and
/System/Applications, and the Homebrew Cellar folder names, all from files; it never runs `brew` and never opens a folder macOS protects with a permission
dialog. For a Mac, a fix is judged per macOS release: Apple lists fixes only for the releases it still patches, so an older release, or a Mac with a
background security improvement letter such as `(a)`, is reported as "undetermined", never as fixed. `--discover --all`, `posture` and `inventory --share` do not read a Mac yet
and stop with a message and exit 3. macOS support is new and has been tried on hosted test machines only: treat a result as a lead, and tell us what you see.
On Debian and Ubuntu, from the signed apt repository:
```bash
sudo curl -fsSL https://namiq.io/apt/lattice-scan.gpg -o /usr/share/keyrings/lattice-scan.gpg
echo "deb [signed-by=/usr/share/keyrings/lattice-scan.gpg] https://namiq.io/apt stable m