# 2s CVE Vulnerability Lookup

> 2s CVE Vulnerability Lookup is a paid API for AI agents from 2s.io, paid per call via x402, $0.0018/call, status unknown (last checked 2026-10-13).

Looks up detailed vulnerability data for a given CVE ID, including CVSS scores, CWEs, EPSS exploit probability, and CISA KEV known-exploited status.

## Facts

- Endpoint: GET https://2s.io/api/security/cve?utm_source=zero.xyz
- Price: $0.0018/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/2s-cve-vulnerability-lookup-1a076cf6
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_c-7GtTrym1C4nc2dCtoul

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 2s-cve-vulnerability-lookup-1a076cf6
```

Example prompt: Can you pull up the full vulnerability details for CVE-2021-44228 — I need the CVSS score, severity, EPSS exploit probability, any associated CWEs, and whether it's listed as a known-exploited vulnerability in the CISA catalog?

## When to prefer this

Use this endpoint when an AI agent needs authoritative, structured vulnerability intelligence for a specific CVE — especially when CVSS scoring, EPSS exploit likelihood, CWE classification, and CISA KEV status are all needed in a single call with no API key or signup required. Prefer this over manual NVD lookups or scraping when programmatic, pay-per-call access is desired.

## Known failure modes

- CVE ID not found — returns empty or null result if the CVE does not exist in the database
- Malformed CVE ID (e.g. missing 'CVE-' prefix or invalid format) — likely returns an error or empty response
- EPSS data not yet available for very recent CVEs — score fields may be null
- NVD data lag for newly published CVEs — some fields may be incomplete shortly after disclosure
- Payment failure via x402 — call not executed if USDC payment is not confirmed

## How this service works

Look up a CVE by id (e.g. CVE-2021-44228) across three authoritative vulnerability feeds in one call. Query: cve (CVE-YYYY-NNNN). Returns the canonical record — description, CVSS base score + severity + vector, CWE weakness ids, published/modified dates, reference links — plus whether it is on the US CISA Known Exploited Vulnerabilities catalog (with remediation due date and known-ransomware flag) and its EPSS exploit-probability score and percentile. The exploited and EPSS sections report independently, so one feed being unavailable does not fail the call. 404 if the CVE id is unknown. For triage, prioritization, and anti-hallucination on vulnerability claims.

## Output

Returns a JSON object with the CVE ID, CVSS version/base score/severity/vector string, list of associated CWEs, EPSS exploit probability score and percentile with date, data sources (e.g. NVD), a human-readable description of the vulnerability, and a knownExploited block indicating CISA KEV listing status, date added, patch due date, and ransomware campaign use flag.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "cve": "CVE-2021-44228"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "required": [
      "cve"
     ],
     "properties": {
      "cve": {
       "type": "string",
       "description": "CVE id, e.g. CVE-2021-44228."
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/2s-cve-vulnerability-lookup-1a076cf6/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)