# AgentDataFeed Vulnerability Watch

> AgentDataFeed Vulnerability Watch is a paid API for AI agents from agentdatafeed.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-29).

Returns a daily-refreshed NVD vulnerability watch for widely used server software, filterable by CVE ID, vendor, product, CVSS score, KEV status, and EPSS score.

## Facts

- Endpoint: GET https://agentdatafeed.com/v1/vulnerability-watch?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentdatafeed-vulnerability-watch-83e24353
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_jE3ToafGY6A98mkNUPRrb

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentdatafeed-vulnerability-watch-83e24353
```

Example prompt: Can you check the vulnerability watch dataset for any critical CVEs affecting Fortinet FortiOS that are in the CISA Known Exploited Vulnerabilities list and have a CVSS score of at least 9?

## When to prefer this

Choose this endpoint when you need structured, machine-readable NVD vulnerability data enriched with CISA KEV membership and EPSS scores, specifically for widely used server software — especially when you want to pay per query without a subscription. Prefer it over raw NVD API calls when you need pre-filtered, agent-ready records with KEV and EPSS already joined. Use the sibling Security Advisories endpoint instead for broader CERT advisory coverage beyond NVD.

## Known failure modes

- CVE ID not found — returns empty records array with total:0
- Invalid min_cvss value outside 0–10 range may return 400 or empty results
- Payment not settled via x402 protocol returns 402 Payment Required
- Malformed ISO date in updated_since returns error or empty set
- Rate limiting if too many requests in a short window

## How this service works

Factual datasets for AI agents, paid per query with x402. Open EU public tenders from TED, EU funding calls and grants, EU medicines with shortages and safety communications from EMA, product recalls and safety alerts from US, Canadian and UK regulators, sanctioned entities and vessels from the EU and OFAC lists, Amsterdam events from official permit notices, security advisories with KEV and EPSS, a daily NVD vulnerability watch for widely used server software, and European national CERT advisories.

## Output

A JSON object containing a paginated list of vulnerability records from the NVD vulnerability watch dataset. Each record includes CVE ID, vendor and product (NVD CPE), CVSS base score and vector, EPSS exploitation probability score, KEV membership flag, CWE identifiers, affected version ranges, a plain-text summary, published and last-updated dates, and a direct link to the NVD advisory page. Also returns total record count, limit, and offset for pagination.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "q": {
       "type": "string",
       "description": "Text in the summary (case-insensitive)"
      },
      "cve": {
       "type": "string",
       "description": "Exact CVE ID, for example CVE-2024-6387"
      },
      "kev": {
       "type": "string",
       "description": "true: only CVEs in CISA KEV"
      },
      "limit": {
       "type": "string",
       "description": "1 to 100, default 50"
      },
      "offset": {
       "type": "string",
       "description": "Default 0"
      },
      "vendor": {
       "type": "string",
       "description": "NVD CPE vendor (substring, case-insensitive)"
      },
      "product": {
       "type": "string",
       "description": "NVD CPE product (substring, case-insensitive)"
      },
      "min_cvss": {
       "type": "string",
       "description": "Minimum CVSS base score, 0 to 10"
      },
      "updated_since": {
       "type": "string",
       "description": "ISO date; NVD last modified on or after"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "limit": 5,
  "total": 1,
  "offset": 0,
  "dataset": "vulnerability-watch",
  "records": [
   {
    "kev": true,
    "cwes": [
     "CWE-787"
    ],
    "epss": 0.83428,
    "cve_id": "CVE-2024-21762",
    "vendor": "fortinet",
    "product": "fortios",
    "summary": "A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests",
    "updated": "2026-10-22",
    "published": "2024-02-09",
    "source_id": "nvd-cve-api",
    "cvss_score": 9.8,
    "source_url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-21762",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "advisory_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21762",
    "retrieved_at": "2026-10-24T04:23:04.865887+00:00",
    "verification": "open-data",
    "paid_placement": false,
    "affected_versions": ">= 6.0.0 < 6.0.18; >= 6.2.0 < 6.2.16; >= 6.4.0 < 6.4.15; >= 7.0.0 < 7.0.14; >= 7.2.0 < 7.2.7; >= 7.4.0 < 7.4.3"
   }
  ],
  "updated": "2026-10-12T00:00:00Z"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentdatafeed-vulnerability-watch-83e24353/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agentdatafeed.com](https://www.zero.xyz/host/agentdatafeed.com/llms.txt)