# Datakoot CISA Known Exploited Vulnerabilities (KEV) Lookup

> Datakoot CISA Known Exploited Vulnerabilities (KEV) Lookup is a paid API for AI agents from x402.datakoot.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-11).

Query the CISA Known Exploited Vulnerabilities catalog to retrieve CVE details, filter by vendor/product, or flag ransomware-linked vulnerabilities.

## Facts

- Endpoint: POST https://x402.datakoot.com/api/known_exploited?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/datakoot-cisa-known-exploited-vulnerabilities-kev-lookup-df408de9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_vyaw2idjp5JUZAO3eFgfk

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability datakoot-cisa-known-exploited-vulnerabilities-kev-lookup-df408de9 -d '<json body>'
```

Example prompt: Check if CVE-2021-44228 (Log4Shell) is in the CISA Known Exploited Vulnerabilities catalog, and tell me whether it's been linked to any ransomware campaigns.

## When to prefer this

Use this endpoint when you need real-time, authoritative data from the CISA KEV catalog — especially for compliance workflows (CISA remediation deadlines), threat intelligence enrichment, or ransomware prioritization. It is preferable to scraping the CISA website directly, querying NVD (which lacks the 'known exploited' and ransomware flags), or using generic CVE databases when the specific requirement is active exploitation evidence recognized by CISA. Ideal for security automation agents that need structured, filterable KEV data per CVE or per vendor at $0.002/call with no subscription.

## Known failure modes

- Invalid CVE ID format returns an empty or error result
- Vendor substring with no matches returns an empty vulnerabilities array
- Limit exceeding 100 is clamped or rejected
- Payment failure via x402 results in no data returned (charged only on success)
- CISA upstream data source temporarily unavailable may return stale or cached data

## How this service works

48 live public-data tools (security, packages, SEC filings, economy, FX, weather, domains, Federal Register, Base) for AI agents. $0.002 USDC per call on Base via x402, charged only on success. The same tools are free for 100 calls/day via MCP at <server>.datakoot.com/mcp.

## Output

A JSON object containing the applied filters, data source attribution (CISA KEV), catalog version and total count, timestamp of the data release, and an array of vulnerability records — each with CVE ID, vulnerability name, affected vendor and product, date added to the catalog, CISA remediation due date, a truncated description, and a boolean indicating known ransomware use.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "limit": {
   "type": "number",
   "description": "When listing, how many newest entries to return (default 20, max 100)."
  },
  "cve_id": {
   "type": "string",
   "description": "Optional. Check a single CVE, e.g. CVE-2021-44228."
  },
  "vendor": {
   "type": "string",
   "description": "Optional. Filter by vendor or product name substring."
  },
  "ransomware_only": {
   "type": "boolean",
   "description": "Optional. Only vulns CISA links to known ransomware campaigns."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "filter": {
   "vendor": null,
   "ransomware_only": false
  },
  "source": "CISA KEV (public domain)",
  "released": "2026-10-02T15:19:38.2945Z",
  "returned": 5,
  "catalog_count": 1733,
  "catalog_version": "2026.10.02",
  "vulnerabilities": [
   {
    "name": "Zammad GmbH Zammad Improper Privilege Management Vulnerability",
    "cve_id": "CVE-2026-102490",
    "vendor": "Zammad GmbH",
    "product": "Zammad",
    "due_date": "2026-10-05",
    "date_added": "2026-10-02",
    "description": "Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escal",
    "known_ransomware_use": false
   },
   {
    "name": "Zammad GmbH Zammad Session Fixation Vulnerability",
    "cve_id": "CVE-2026-102489",
    "vendor": "Zammad GmbH",
    "product": "Zammad",
    "due_date": "2026-10-05",
    "date_added": "2026-10-02",
    "description": "Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. ",
    "known_ransomware_use": false
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/datakoot-cisa-known-exploited-vulnerabilities-kev-lookup-df408de9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.datakoot.com](https://www.zero.xyz/host/x402.datakoot.com/llms.txt)