# Dragons Eye CVE Batch Lookup

> Dragons Eye CVE Batch Lookup is a paid API for AI agents from api.ransomware-tracker.com, paid per call via x402, $0.5/call, status unknown (last checked 2026-10-27).

Fetches full CVE intelligence bundles for up to 50 CVEs in a single call, including CVSS scores, exploit data, EPSS, KEV status, ransomware usage, and AI-generated ATT&CK attack flows.

## Facts

- Endpoint: GET https://api.ransomware-tracker.com/v1/cve-batch?utm_source=zero.xyz
- Price: $0.5/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-27
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dragons-eye-cve-batch-lookup-ad0cd5a5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Y8uH9xoD7EcrZ3-55E8yk

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dragons-eye-cve-batch-lookup-ad0cd5a5
```

Example prompt: Can you pull the full threat intel bundle for CVE-2024-1234, CVE-2023-44487, and CVE-2021-44228 — I need their CVSS scores, EPSS, whether they're in KEV, any public exploits, and the ATT&CK attack flow for each?

## When to prefer this

Use this endpoint when you need to enrich multiple CVEs (up to 50) in a single efficient call instead of making individual CVE lookups. It is ideal for batch vulnerability triage, patch prioritization workflows, or SIEM/SOAR integrations where ransomware risk, EPSS, KEV status, and ATT&CK attack flows are all needed together. Prefer this over the single-CVE endpoint whenever processing scanner output, alert batches, or vulnerability reports containing multiple CVE identifiers.

## Known failure modes

- 404 returned if fewer than half of the requested CVEs are covered — no charge applied, covered list still returned
- Invalid or malformed CVE IDs may be skipped or returned as uncovered
- Exceeding 50 CVEs in a single request may be rejected
- Network or API downtime returns standard HTTP 5xx errors
- Payment failure (x402) results in request not being processed

## How this service works

Dragons Eye Lookup: CVE intel bundle: up to 50 CVEs in one call. The /v1/cve record for up to 50 CVEs (comma-separated). Charged only if at least half of them are covered; otherwise 404 with the covered list, not charged. Uncovered ids are listed and queued.

## Output

Returns a JSON object with the count of covered CVEs, a results array where each entry contains: CVE ID, CVSS v3 score and severity, affected products, D3FEND countermeasures, exploit count and GitHub exploit links, AI-generated ATT&CK attack flow steps with tactic and technique IDs, EPSS score, KEV inclusion status, ransomware use flag, and public exploit availability. Also returns the total requested count and a list of uncovered CVE IDs (which are queued for future coverage). If fewer than half the requested CVEs are covered, returns 404 with the covered list and no charge.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ids"
     ],
     "properties": {
      "ids": {
       "type": "string",
       "maxLength": 1000,
       "description": "Comma-separated CVE ids, max 50"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "covered": 2,
  "results": [
   {
    "cve_id": "CVE-2026-0257",
    "summary": {
     "cvss_v3": 9.1,
     "cvss_v3_severity": "CRITICAL",
     "affected_products": [
      "pan-os"
     ]
    },
    "defenses": {
     "countermeasures": [
      {
       "url": "https://d3fend.mitre.org/technique/d3f:SoftwareUpdate/",
       "label": "Software Update",
       "tactic": "Harden",
       "d3fend_id": "D3-SU"
      }
     ]
    },
    "exploits": {
     "count": 9,
     "items": [
      {
       "url": "https://github.com/example/CVE-2026-0257",
       "name": "example/CVE-2026-0257",
       "stars": 1
      }
     ]
    },
    "attack_flow": {
     "steps": [
      {
       "step": "initial_access",
       "label": "Exploit public-facing application",
       "tactic": "TA0001",
       "technique": "T1190"
      }
     ],
     "status": "ok",
     "ai_generated": true
    },
    "exploitation": {
     "epss": 0.969,
     "in_kev": true,
     "ransomware_use": "Unknown",
     "has_public_exploit": true
    },
    "data_refreshed_at": "2026-10-17T06:00:00Z"
   }
  ],
  "requested": 2,
  "not_covered": []
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dragons-eye-cve-batch-lookup-ad0cd5a5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.ransomware-tracker.com](https://www.zero.xyz/host/api.ransomware-tracker.com/llms.txt)