# CISA Known Exploited Vulnerabilities Lookup

> CISA Known Exploited Vulnerabilities Lookup is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-25).

Checks whether a CVE is on CISA's Known Exploited Vulnerabilities (KEV) catalog, or returns catalog-level statistics and newest additions if no CVE is specified.

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/cisa-known-exploits?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-25
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cisa-known-exploited-vulnerabilities-lookup-efb23e3e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_BwvtFNfYNtLN-8VseiTmk

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cisa-known-exploited-vulnerabilities-lookup-efb23e3e
```

Example prompt: Check whether CVE-2023-44487 (the HTTP/2 Rapid Reset vulnerability) is on the CISA Known Exploited Vulnerabilities list, and if so tell me the vendor, product, date it was added, the federal remediation deadline, and whether it's been used in ransomware attacks.

## When to prefer this

Use this endpoint when you need to determine whether a specific CVE has confirmed real-world exploitation as recognized by CISA, or to retrieve federal compliance deadlines (due dates) for patching. Prefer this over generic CVSS/NVD lookups when the question is 'has this been exploited in the wild and does it require federal remediation?' rather than 'what is the theoretical severity score?' It is ideal for compliance-driven patch prioritization and ransomware risk screening.

## Known failure modes

- CVE ID not found in KEV catalog — returns a not-listed result, not an error
- Invalid CVE ID format may return an error or empty result
- limit parameter outside 1–50 range may be clamped or return an error
- Upstream CISA JSON unavailable causes service failure
- Network timeout from Cloudflare Worker if CISA source is slow

## How this service works

CISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, required action and ransomware-use flag. Without it: catalog size, release date and the newest additions (up to 50). Listing means exploitation was reported, not a risk score.

## Output

When a cveId is provided: a JSON object with the CVE's KEV status (listed or not), vendor, product, date added to the catalog, federal remediation due date, CISA-mandated required action, and a ransomware-use flag. Without a cveId: the total catalog size, the catalog release/last-updated date, and the most recent additions (up to the requested limit, default 10, max 50).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "cveId": {
       "type": "string",
       "description": "CVE identifier to look up (optional)"
      },
      "limit": {
       "type": "string",
       "description": "How many newest additions to list when no cveId is given, 1 to 50 (default 10)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cisa-known-exploited-vulnerabilities-lookup-efb23e3e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)