# CISA KEV Feed with EPSS Scores

> CISA KEV Feed with EPSS Scores is a paid API for AI agents from cve.genexxis.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-30).

Returns filtered CISA Known Exploited Vulnerabilities catalog entries enriched with FIRST EPSS exploit probability scores, due dates, and required actions.

## Facts

- Endpoint: GET https://cve.genexxis.com/kev?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cisa-kev-feed-with-epss-scores-038576a2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_bv_0CGLMitDbgLwzKlwTQ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cisa-kev-feed-with-epss-scores-038576a2
```

Example prompt: Pull the CISA Known Exploited Vulnerabilities added in the last 14 days for Microsoft products, and include their EPSS scores and due dates so I can prioritize patching.

## When to prefer this

Choose this endpoint when you need pre-joined CISA KEV + EPSS data in a single call without building your own data pipeline. It is ideal for security operations dashboards, patch prioritization workflows, compliance reporting against CISA Binding Operational Directive 22-01, and threat intelligence briefings. Prefer this over raw NVD or CISA catalog downloads when you need filtered, scored, and actionable vulnerability lists quickly.

## Known failure modes

- Invalid 'days' value exceeding 3650 returns an error or empty result
- Invalid 'ransomware' enum value (not 'known' or 'unknown') may cause a bad request
- 'maxItems' exceeding 100 may be clamped or rejected
- Vendor or product name typos result in empty item sets
- Upstream CISA or EPSS data refresh delays may produce stale results
- Network timeouts if CISA or FIRST data sources are temporarily unavailable

## How this service works

Vulnerability intelligence for triage agents. /cve looks up a CVE id or searches NVD by keyword (same params as other CVE APIs: id or keyword, severity, maxItems, plus days) and returns CVSS v3.1 and v4.0 scores and vectors, CWE, affected CPE products, references, plus the CISA Known Exploited Vulnerabilities status (date added, due date, ransomware use, required action), the FIRST EPSS exploitation probability and percentile, and a one-line patch priority. /kev lists the latest actively exploited CVEs with EPSS. /packages scans up to 50 open-source dependencies (npm, PyPI, Maven, Go, crates.io, NuGet, RubyGems, ...) against OSV.dev with fixed versions and KEV/EPSS joined. NVD live (cached 1 h), KEV and EPSS refreshed every 6 h.

## Output

A JSON object containing the query timestamp, total KEV catalog size, catalog version, EPSS score date, a count of matched items, and an array of vulnerability entries each with CVE ID, CWE, NVD URL, vendor, product, date added, CISA due date, required action text, ransomware campaign use flag, and EPSS score plus percentile.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "days": {
       "type": "string",
       "description": "Added to KEV within the last N days (default 30, max 3650)"
      },
      "vendor": {
       "type": "string",
       "description": "Vendor name contains, e.g. Microsoft"
      },
      "product": {
       "type": "string",
       "description": "Product name contains, e.g. Exchange"
      },
      "maxItems": {
       "type": "string",
       "description": "Default 50, max 100"
      },
      "ransomware": {
       "enum": [
        "known",
        "unknown"
       ],
       "type": "string",
       "description": "Known ransomware campaign use"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "asOf": "2026-10-25T03:40:00.000Z",
  "count": 1,
  "items": [
   {
    "id": "CVE-2026-114625",
    "cwe": [
     "CWE-287"
    ],
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114625",
    "epss": {
     "score": 0.31,
     "percentile": 0.97
    },
    "name": "Arista VeloCloud Orchestrator Improper Authentication Vulnerability",
    "vendor": "Arista",
    "dueDate": "2026-10-26",
    "product": "VeloCloud Orchestrator",
    "dateAdded": "2026-10-23",
    "description": "Arista VeloCloud Orchestrator on-prem contains an improper authentication weakness...",
    "requiredAction": "Apply mitigations in accordance with vendor instructions...",
    "knownRansomwareCampaignUse": "Unknown"
   }
  ],
  "total": 21,
  "source": "CISA Known Exploited Vulnerabilities catalog + FIRST EPSS",
  "kevTotal": 1756,
  "kevCatalog": "2026.10.23",
  "epssScoreDate": "2026-10-24"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cisa-kev-feed-with-epss-scores-038576a2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from cve.genexxis.com](https://www.zero.xyz/host/cve.genexxis.com/llms.txt)