# CVE Lookup with CVSS, EPSS, and CISA KEV > CVE Lookup with CVSS, EPSS, and CISA KEV is a paid API for AI agents from agent402.tools, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-10). Look up CVE vulnerability details by ID or keyword, enriched with CVSS scores, EPSS exploitation probability, and CISA Known Exploited Vulnerabilities catalog status. ## Facts - Endpoint: POST https://agent402.tools/api/cve-lookup?utm_source=zero.xyz - Price: $0.005/call - Payment: x402 - Status: unknown - Last checked: 2026-10-10 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/cve-lookup-with-cvss-epss-and-cisa-kev-596bf445 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ngwYfKTGleU5o1u2vXIrS Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability cve-lookup-with-cvss-epss-and-cisa-kev-596bf445 -d '' ``` Example prompt: Look up CVE-2024-3094 and include the EPSS exploitation probability and CISA KEV status — I need the CVSS score, affected products, and whether it's been actively exploited. ## When to prefer this Use this endpoint when you need enriched, structured CVE intelligence in a single call — specifically when you want NVD vulnerability data combined with EPSS exploitation probability and CISA KEV status without building multiple API integrations. Ideal for security triage workflows, patch prioritization, compliance checks, and automated vulnerability reporting. Prefer over raw NVD API calls when you want EPSS and KEV data joined automatically. No signup or API key required — pay $0.005 USDC per call via x402. ## Known failure modes - CVE ID not found in NVD — returns matched:0 with empty results array - Invalid CVE format — may return validation error or zero results - Keyword too short (under 3 chars) or too long (over 100 chars) — input validation error - Neither cve nor keyword provided — missing required field error - EPSS or KEV data temporarily unavailable — available flag set to false in respective sub-object - Payment not received via x402 — 402 Payment Required response before results are returned ## How this service works Look up a CVE by id, or search CVEs by keyword or product: the NVD description, CVSS severity and vector (v4.0, v3.1, v2), CWE weaknesses, affected products and versions (CPE), and reference links, joined with the EPSS exploitation probability (next 30 days) and whether CISA lists it as a known exploited vulnerability (date added, due date, ransomware use). This product uses the NVD API but is not endorsed or certified by the NVD. ## Output Returns a JSON object with matched CVE records including: CVE ID, CVSS v2/v3.1/v4.0 scores and vectors, severity rating, CWE classifications, EPSS exploitation probability and percentile, CISA KEV catalog membership status, list of affected products with CPE strings, publication and last-modified dates, NVD URL, and reference links. Also includes data source attribution for NVD, KEV, and EPSS. ## Request schema (JSON Schema) ```json { "type": "object", "properties": { "cve": { "type": "string", "description": "A CVE id, e.g. CVE-2024-3094. Give this or keyword." }, "kev": { "type": "boolean", "description": "Join the CISA KEV catalog entry (default true)." }, "epss": { "type": "boolean", "description": "Join the EPSS exploitation probability (default true)." }, "limit": { "type": "integer", "description": "Keyword search: records to return, 1 to 20 (default 5)." }, "keyword": { "type": "string", "description": "Words to search CVE descriptions for, e.g. \"openssl heap overflow\" (3-100 chars). Give this or cve." } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "query": { "cve": "CVE-2024-3094" }, "matched": 1, "results": [ { "id": "CVE-2024-3094", "kev": { "available": true, "inCatalog": false, "catalogVersion": "2026.09.25" }, "cvss": { "v2": null, "v31": { "type": "Primary", "score": 10, "source": "nvd@nist.gov", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "CRITICAL" }, "v40": null }, "cwes": [ "CWE-506" ], "epss": { "date": "2026-09-25", "available": true, "percentile": 0.99723, "probability": 0.85974 }, "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3094", "status": "Modified", "affected": { "total": 1, "complete": true, "products": [ { "cpe": "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*", "vendor": "tukaani", "product": "xz", "version": "5.6.0" } ], "returned": 1 }, "severity": "CRITICAL", "published": "2024-03-29T17:15:21.150", "references": { "links": [ { "url": "https://access.redhat.com/security/cve/CVE-2024-3094", "tags": [ "Vendor Advisory" ] } ], "total": 1, "returned": 1 }, "description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0...", "lastModified": "2025-11-04T22:16:02.230" } ], "sources": { "kev": { "name": "CISA Known Exploited Vulnerabilities catalog (CC0)" }, "nvd": { "name": "NVD (NIST National Vulnerability Database)", "notice": "This product uses the NVD API but is not endorsed or certified by the NVD." }, "epss": { "name": "EPSS, Exploit Prediction Scoring System (FIRST.org; scores by Empirical Security)" } }, "complete": true, "returned": 1, "fetchedAt": "2026-09-25T16:40:00.000Z", "truncated": false } } ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cve-lookup-with-cvss-epss-and-cisa-kev-596bf445/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from agent402.tools](https://www.zero.xyz/host/agent402.tools/llms.txt)