# CISA KEV Vendor Vulnerability Intelligence

> CISA KEV Vendor Vulnerability Intelligence is a paid API for AI agents from vuln-intel.x402tookit.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-21).

Returns the count of CISA Known Exploited Vulnerabilities, affected products, ransomware usage, and latest CVE additions for a given vendor.

## Facts

- Endpoint: GET https://vuln-intel.x402tookit.com/kev-vendor?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cisa-kev-vendor-vulnerability-intelligence-859415a2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_fjtD1kYS-hoo3ZwxVG1HL

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cisa-kev-vendor-vulnerability-intelligence-859415a2
```

Example prompt: Pull the CISA KEV vendor profile for Ivanti — I want to know how many exploited CVEs they have, which products are most affected, and whether any are tied to ransomware.

## When to prefer this

Use this endpoint when you need a vendor-level aggregated view of exploited vulnerabilities from the CISA KEV catalog — specifically when you want ransomware linkage, product breakdowns, and recency signals for a named vendor rather than a single CVE or package lookup. Prefer this over CVE-specific endpoints when conducting vendor risk assessments, procurement due diligence, or threat briefings.

## Known failure modes

- Vendor name not found or matched — returns empty or null vendorsMatched with no KEV data
- Ambiguous vendor name matching multiple vendors — may return aggregated or partial results
- CISA KEV data source temporarily unavailable — degraded flag set to true with stale or null data
- Missing required vendor query parameter — request rejected with validation error
- Vendor has zero KEV entries — returns valid response with kevCves of 0 and empty latest list

## How this service works

Exploited-vulnerability record of a vendor in CISA KEV: total CVEs, products, ransomware use and latest additions.

## Output

Returns a structured record including: total number of CVEs in CISA KEV for the vendor, a verdict and human-readable summary, list of top affected products with CVE counts, ransomware use count, the most recently added CVEs (with CVE ID, product, and date added), matched vendor name(s), data source and URL, and optional thresholds or degraded-mode flags.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "vendor"
     ],
     "properties": {
      "vendor": {
       "type": "string",
       "description": "Vendor name or part, e.g. Microsoft, Fortinet, Ivanti"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "asOf": {
       "type": [
        "null",
        "string"
       ]
      },
      "latest": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "object",
        "properties": {
         "cve": {
          "type": [
           "null",
           "string"
          ]
         },
         "product": {
          "type": [
           "null",
           "string"
          ]
         },
         "dateAdded": {
          "type": [
           "null",
           "string"
          ]
         }
        }
       }
      },
      "source": {
       "type": [
        "null",
        "string"
       ]
      },
      "kevCves": {
       "type": [
        "null",
        "number"
       ]
      },
      "reasons": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "string"
       }
      },
      "summary": {
       "type": [
        "null",
        "string"
       ]
      },
      "verdict": {
       "type": [
        "null",
        "string"
       ]
      },
      "degraded": {
       "type": [
        "boolean",
        "null"
       ]
      },
      "sourceUrl": {
       "type": [
        "null",
        "string"
       ]
      },
      "disclaimer": {
       "type": [
        "null",
        "string"
       ]
      },
      "notChecked": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "string"
       }
      },
      "thresholds": {
       "type": [
        "null",
        "object"
       ],
       "properties": {
        "severalAt": {
         "type": [
          "null",
          "n
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cisa-kev-vendor-vulnerability-intelligence-859415a2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from vuln-intel.x402tookit.com](https://www.zero.xyz/host/vuln-intel.x402tookit.com/llms.txt)