# 2s CVE Changes Feed

> 2s CVE Changes Feed is a paid API for AI agents from 2s.io, paid per call via x402, $0.00216/call, status unknown (last checked 2026-10-12).

Retrieves recently added or modified CVE vulnerability records from NVD/CISA within a specified time window, with optional CPE and keyword filters.

## Facts

- Endpoint: GET https://2s.io/api/security/cve-changes?utm_source=zero.xyz
- Price: $0.00216/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/2s-cve-changes-feed-3e1e7036
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_vQBbCdMwAo7sbin8mYlMW

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 2s-cve-changes-feed-3e1e7036
```

Example prompt: Pull all CVEs that were added or modified between June 14 and June 15, 2026 — filter to anything matching 'nginx' and give me up to 50 results.

## When to prefer this

Use this endpoint when you need ground-truth CVE data sourced directly from NVD and CISA KEV, especially for time-bounded change feeds (e.g. daily digests, incident response, patch management automation). Prefer this over scraping NVD directly because it returns structured JSON with CVSS and KEV enrichment in one call, is pay-per-call with no signup, and supports CPE/keyword filtering out of the box.

## Known failure modes

- Missing required 'since' parameter returns a validation error
- Time window exceeding 120 days returns an error
- Invalid date format for 'since' or 'until' causes a parsing error
- Invalid CPE string may return zero results rather than an error
- Limit outside 1-100 range may be rejected or clamped
- NVD upstream unavailability may cause 5xx errors or empty results

## How this service works

CVE change feed — the CVE records MODIFIED within a time window, so an agent can incrementally maintain a vulnerability view instead of re-scanning. Pass since (YYYY-MM-DD or ISO datetime); until defaults to now (window must be ≤ 120 days, the NVD limit). Optionally narrow by keyword (product/text) or cpe (exact CPE). Returns each changed CVE with its id, published + lastModified timestamps, current vulnStatus (e.g. Modified, Analyzed, Rejected), best-available CVSS score/severity, description, and kevListed — whether it is now on the CISA Known-Exploited Vulnerabilities catalog (the high-signal flag for a poller). Newest modification first. Sourced live from NVD (NIST) + CISA KEV, free/keyless. Pair with security.cve for full per-CVE detail.

## Output

A JSON object containing an array of CVE records matching the time window and filters, each with CVE ID, CVSS version/severity/base score, KEV listing status, publication date, last modified date, vulnerability status, and description. Also includes metadata with total count and the query window.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "required": [
      "since"
     ],
     "properties": {
      "cpe": {
       "type": "string",
       "description": "Optional exact CPE name filter."
      },
      "limit": {
       "type": "integer",
       "description": "Max results (1-100, default 40)."
      },
      "since": {
       "type": "string",
       "description": "Window start (YYYY-MM-DD or ISO datetime)."
      },
      "until": {
       "type": "string",
       "description": "Window end (default now). Max 120-day window."
      },
      "keyword": {
       "type": "string",
       "description": "Optional product/text filter."
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/2s-cve-changes-feed-3e1e7036/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)