# CISA KEV Exploited Vulnerabilities Lookup > CISA KEV Exploited Vulnerabilities Lookup is a paid API for AI agents from api.vextorium.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-11). Returns actively exploited vulnerabilities from CISA's Known Exploited Vulnerabilities (KEV) catalog, filterable by recency, vendor/product, or ransomware association. ## Facts - Endpoint: POST https://api.vextorium.com/v1/exploited-vulnerabilities?utm_source=zero.xyz - Price: $0.003/call - Payment: x402 - Status: unknown - Last checked: 2026-10-11 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/cisa-kev-exploited-vulnerabilities-lookup-83fbdf5d - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_RBBahXzsNSOwK5Tv7b__p Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability cisa-kev-exploited-vulnerabilities-lookup-83fbdf5d -d '' ``` Example prompt: Pull all Fortinet vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog in the last 30 days and flag any that are associated with ransomware. ## When to prefer this Use this endpoint when you need structured, up-to-date data from CISA's authoritative KEV catalog — the gold standard for actively exploited vulnerabilities. Prefer this over generic NVD or CVE database lookups when the specific requirement is known exploitation in the wild and government-mandated remediation deadlines. Especially valuable for federal agencies subject to BOD 22-01, security operations centers doing triage, and compliance teams needing ransomware exposure data. ## Known failure modes - Invalid or missing body fields may return a 400 error - Search term with no matches returns an empty vulnerabilities array with matches: 0 - Very broad queries without a limit may return large payloads — use the limit parameter - Network timeout if CISA source data is temporarily unavailable - Stale catalog data if upstream CISA feed has not been recently refreshed ## How this service works Vulnerabilities being actively exploited according to CISA's KEV catalog: CVE, vendor, product, name, description, date added, remediation due date and ransomware use; the latest N days or search by vendor/product (Microsoft, Cisco, Fortinet...). ## Output Returns a JSON object with the CISA KEV catalog date, total catalog size, number of matches, and an array of vulnerability records each containing: CVE ID, CWE classifications, vulnerability name, manufacturer, product, description, date added (high), remediation due date (correction_term), required action text, and ransomware association status (Known/Unknown/No Known). ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method", "bodyType", "body" ], "properties": { "body": { "required": [], "properties": { "days": { "type": "integer" }, "limit": { "type": "integer" }, "search": { "type": "string" }, "ransomware": { "type": "boolean" } } }, "type": { "type": "string", "const": "http" }, "method": { "enum": [ "POST" ], "type": "string" }, "bodyType": { "enum": [ "json", "form-data", "text" ], "type": "string" } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": [ "object", "null" ], "properties": { "source": { "type": [ "string", "null" ] }, "catalog": { "type": [ "string", "null" ] }, "matches": { "type": [ "number", "null" ] }, "total_catalog": { "type": [ "number", "null" ] }, "vulnerabilities": { "type": [ "array", "null" ], "items": { "type": [ "null", "object" ], "properties": { "cve": { "type": [ "null", "string" ] }, "cwe": { "type": [ "array", "null" ], "items": { "type": [ "null", "string" ] } }, "high": { "type": [ "null", "string" ] }, "name": { "type": [ "null", "string" ] }, "action": { "type": [ "null", "string" ] }, "product": { "type": [ "null", "string" ] }, "ransomware": { "type": [ "null", "string" ] }, "description": { "type": [ "null", … (truncated) ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "source": "CISA Known Exploited Vulnerabilities (US public domain)", "catalog": "2026.10.02", "matches": 17, "total_catalog": 1733, "vulnerabilities": [ { "cve": "CVE-2026-102490", "cwe": [ "CWE-269" ], "high": "2026-10-02", "name": "Zammad GmbH Zammad Improper Privilege Management Vulnerability", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discon…", "product": "Zammad", "ransomware": "Unknown", "description": "Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.", "manufacturer": "Zammad GmbH", "correction_term": "2026-10-05" }, { "cve": "CVE-2026-102489", "cwe": [ "CWE-384" ], "high": "2026-10-02", "name": "Zammad GmbH Zammad Session Fixation Vulnerability", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discon…", "product": "Zammad", "ransomware": "Unknown", "description": "Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.", "manufacturer": "Zammad GmbH", "correction_term": "2026-10-05" } ] } } ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cisa-kev-exploited-vulnerabilities-lookup-83fbdf5d/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from api.vextorium.com](https://www.zero.xyz/host/api.vextorium.com/llms.txt)