# fittings CVE Search

> fittings CVE Search is a paid API for AI agents from fittings.sh, paid per call via x402, $0.00596/call, status unknown (last checked 2026-10-10).

Search the National Vulnerability Database (NVD) by keyword, CPE, date range, or CVSS severity, returning paginated CVE records with scores and CWE classifications.

## Facts

- Endpoint: GET https://fittings.sh/v1/cve/search?utm_source=zero.xyz
- Price: $0.00596/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/fittings-cve-search-26485f36
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_hWnO8y3emui2oDerAuRML

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability fittings-cve-search-26485f36
```

Example prompt: Search the NVD for CRITICAL severity CVEs matching 'remote code execution' published between 2024-01-01 and 2024-03-31, and return the first 20 results.

## When to prefer this

Use this endpoint when you need to query the authoritative NIST NVD for CVE data with flexible filters — keyword, CPE, severity, or date range — and want a straightforward paginated JSON response. Prefer it over the GitHub Advisory Database endpoint (also on fittings.sh) when you need broad NVD coverage rather than GitHub-ecosystem-specific advisories, or when you don't have a specific GHSA/CVE ID to look up directly.

## Known failure modes

- Invalid or malformed CPE string returns no results or a 400 error
- publishedFrom/publishedTo date window exceeding 120 days returns an error
- Missing publishedFrom when publishedTo is supplied (or vice versa) causes a validation error
- Offset beyond 10000 is rejected
- Severity value outside LOW/MEDIUM/HIGH/CRITICAL is invalid
- No matching CVEs returns an empty result list
- Rate limiting or upstream NVD API unavailability may cause transient failures

## How this service works

Search the National Vulnerability Database by keyword, CPE, publication window or CVSS severity, returning a paginated list with scores and CWE classifications.

## Output

A paginated list of CVE records from the NVD, each including the CVE ID, CVSS v3 severity and base score, CWE classification(s), a human-readable vulnerability description, and publication/modification dates. The response also includes total result count to support further pagination.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "cpe": {
       "type": "string",
       "description": "CPE 2.3 match string, e.g. cpe:2.3:a:apache:log4j"
      },
      "exact": {
       "type": "boolean",
       "description": "Match the keyword as an exact phrase"
      },
      "limit": {
       "type": "number",
       "description": "1-50, default 10"
      },
      "offset": {
       "type": "number",
       "description": "0-10000, default 0"
      },
      "keyword": {
       "type": "string",
       "description": "Words to match in the description; multiple words are ANDed"
      },
      "severity": {
       "type": "string",
       "description": "LOW | MEDIUM | HIGH | CRITICAL (CVSS v3)"
      },
      "publishedTo": {
       "type": "string",
       "description": "YYYY-MM-DD; requires publishedFrom"
      },
      "publishedFrom": {
       "type": "string",
       "description": "YYYY-MM-DD; requires publishedTo, window at most 120 days"
      },
      "includeRejected": {
       "type": "boolean",
       "description": "Include withdrawn CVE records, default false"
      }
     }
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/fittings-cve-search-26485f36/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from fittings.sh](https://www.zero.xyz/host/fittings.sh/llms.txt)