# 2s CVE Exploit Availability Lookup

> 2s CVE Exploit Availability Lookup is a paid API for AI agents from 2s.io, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-13).

Returns known public exploits for a given CVE ID, including exploit URLs, types, platforms, verification status, and Metasploit module availability.

## Facts

- Endpoint: GET https://2s.io/api/security/exploit-availability
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/2s-cve-exploit-availability-lookup-cb3b8ce7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Ax6SIKfe1NXHU5wKdkSpM

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 2s-cve-exploit-availability-lookup-cb3b8ce7
```

Example prompt: Can you check whether CVE-2021-44228 (Log4Shell) has any publicly known exploits, and tell me if there's a verified one or a Metasploit module available?

## When to prefer this

Use this endpoint when you need to quickly determine whether a specific CVE has publicly available exploit code, verified exploits, or Metasploit modules — especially useful for vulnerability prioritization, patch management triage, or security research. Prefer this over manual Exploit-DB searches when an AI agent needs structured, machine-readable exploit availability data for a CVE without requiring API keys or signup.

## Known failure modes

- CVE ID not found or has no recorded exploits — returns empty items array with total 0
- Malformed CVE ID format causes validation error
- Payment failure via x402 prevents request from being processed
- Upstream Exploit-DB data unavailable causes service error

## How this service works

Does public exploit code exist for a CVE, and where? Pass cve (e.g. CVE-2021-44228). Returns hasPublicExploit, the count, hasMetasploitModule and hasVerifiedExploit flags, and the Exploit-DB entries (id, description, type, platform, date, verified, Metasploit flag, link). Bundled inverted index from the Exploit-DB archive (~25k CVEs). This is the triage signal BEYOND security.cve's KEV (exploited in the wild) + EPSS (exploit probability): is the vulnerability actually weaponized with available code? Use the trio together to decide how urgently to patch. Absence is not proof no exploit exists (private/other archives not covered).

## Output

Returns a JSON object containing an array of exploit entries for the queried CVE, each with its Exploit-DB URL, date, type (e.g. remote), platform (e.g. java), Exploit-DB ID, whether it is verified, and whether a Metasploit module exists. Also returns aggregate flags: hasPublicExploit, hasVerifiedExploit, hasMetasploitModule, and total exploit count. Includes source attribution to Exploit-DB.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "cve": "CVE-2021-44228"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "required": [
      "cve"
     ],
     "properties": {
      "cve": {
       "type": "string",
       "description": "CVE id, e.g. CVE-2021-44228."
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/2s-cve-exploit-availability-lookup-cb3b8ce7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)