# 2s CVE Search — NIST NVD Vulnerability Lookup

> 2s CVE Search — NIST NVD Vulnerability Lookup is a paid API for AI agents from 2s.io, paid per call via x402, $0.00216/call, status unknown (last checked 2026-09-15).

Search the NIST National Vulnerability Database (NVD) for CVEs by product name, keyword, or exact CPE 2.3 identifier, returning CVSS scores, severity, and descriptions.

## Facts

- Endpoint: GET https://2s.io/api/security/cve-search
- Price: $0.00216/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/2s-cve-search-nist-nvd-vulnerability-lookup-a39900e3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_0xVKJnVqgql2AuFqF9Etv

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 2s-cve-search-nist-nvd-vulnerability-lookup-a39900e3
```

Example prompt: Search for known CVEs affecting Apache Log4j — give me up to 20 results with their CVSS scores and severity ratings.

## When to prefer this

Use this endpoint when an AI agent needs ground-truth CVE data from the authoritative NIST NVD source, especially for vulnerability triage, security audits, dependency scanning, or risk assessment workflows. Prefer over general web search when structured CVSS scores, severity ratings, and official CVE IDs are required. The pay-per-call, no-signup model makes it ideal for on-demand agent workflows without credential management.

## Known failure modes

- No CVEs found for the given product or CPE — returns empty items array with total 0
- Invalid CPE format — may return no results or an error
- limit parameter out of range (below 1 or above 50) — may be clamped or return an error
- Ambiguous product keyword matching unintended software — results may include unrelated CVEs
- NVD upstream unavailability — endpoint may return an error or stale data

## How this service works

Find vulnerabilities affecting a product by searching the NIST National Vulnerability Database. Pass product (free-text keyword, e.g. "apache log4j", "openssl", "wordpress plugin contact-form-7") or cpe (an exact CPE 2.3 name, e.g. cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*). Returns matching CVEs newest-first, each with its id, description, CVSS base score/severity/vector, and dates. Optional limit (1–50). For "what CVEs affect X" / surveying a product's vulnerability history — distinct from security.cve, which resolves a single CVE id across NVD + CISA KEV + EPSS. Free, keyless.

## Output

A JSON object with an 'ok' boolean, metadata including the query string and total match count, an array of CVE items (each with CVE ID, CVSS base score, severity label, vector string, published date, last modified date, and description), and source attribution pointing to the NIST NVD under public domain license.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "properties": {
      "cpe": {
       "type": "string",
       "description": "Exact CPE 2.3 name."
      },
      "limit": {
       "type": "integer",
       "description": "Max CVEs (1–50, default 20)."
      },
      "product": {
       "type": "string",
       "description": "Free-text product/keyword to search."
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/2s-cve-search-nist-nvd-vulnerability-lookup-a39900e3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)