# AgentDataFeed Security Advisories

> AgentDataFeed Security Advisories is a paid API for AI agents from agentdatafeed.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-13).

Fetches CISA KEV entries with EPSS exploit probability scores, ransomware campaign flags, patch-priority data, and required remediation actions for CVEs by vendor, product, or keyword

## Facts

- Endpoint: GET https://agentdatafeed.com/v1/security-advisories?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentdatafeed-security-advisories-1d82138d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Zcy5WFgqc64oxV-6yfS1W

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentdatafeed-security-advisories-1d82138d
```

Example prompt: Is CVE-2023-34362 actively exploited — pull its CISA KEV entry with the remediation due date, required action, and FIRST EPSS probability score so I know how urgently to patch it.

## When to prefer this

Choose this endpoint when you need a single call that combines CISA KEV status, remediation deadlines, required actions, ransomware campaign association, and FIRST EPSS probability for one or more CVEs. It is ideal for patch prioritization workflows, security briefings, and vulnerability triage where you need authoritative exploit-activity signals rather than raw NVD data alone.

## Known failure modes

- No results returned if CVE ID is malformed or not in the KEV catalog
- Empty result set when vendor/product substring matches nothing — try broader search terms
- Invalid min_epss value outside 0–1 range may return an error
- Pagination offset beyond total results returns empty list
- Rate limiting or payment failure (402) if x402 USDC payment is not processed correctly

## How this service works

Security advisories: Use when a user asks whether a CVE is actively exploited, which vulnerabilities in a vendor or product to patch first, whether it is used in ransomware campaigns, or needs CISA KEV due dates, required actions and FIRST EPSS exploit probability in one call.

## Output

Returns a paginated list of vulnerability records from the CISA KEV catalog, each containing the CVE ID, vulnerability name, summary, affected vendor and product, CISA-mandated remediation due date, required action text, EPSS exploit probability score, ransomware campaign usage flag, and KEV date-added timestamp.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "q": {
       "type": "string",
       "description": "Text in vulnerability name or summary (case-insensitive)"
      },
      "cve": {
       "type": "string",
       "description": "Exact CVE ID, for example CVE-2021-44228"
      },
      "limit": {
       "type": "string",
       "description": "1 to 100, default 50"
      },
      "offset": {
       "type": "string",
       "description": "Default 0"
      },
      "vendor": {
       "type": "string",
       "description": "Vendor name (substring, case-insensitive)"
      },
      "product": {
       "type": "string",
       "description": "Product name (substring, case-insensitive)"
      },
      "min_epss": {
       "type": "string",
       "description": "Minimum EPSS probability, 0 to 1"
      },
      "ransomware": {
       "type": "string",
       "description": "known: only vulnerabilities with known ransomware campaign use"
      },
      "added_since": {
       "type": "string",
       "description": "ISO date; KEV date added on or after"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentdatafeed-security-advisories-1d82138d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agentdatafeed.com](https://www.zero.xyz/host/agentdatafeed.com/llms.txt)