# OpenVerbs KEV Lookup

> OpenVerbs KEV Lookup is a paid API for AI agents from scan.openverbs.com, paid per call via x402, $0.006/call, status unknown (last checked 2026-10-13).

Check up to 50 CVE IDs against CISA's Known Exploited Vulnerabilities catalog, returning membership status, vendor/product info, exploitation evidence, ransomware association, and remediation guidance

## Facts

- Endpoint: POST https://scan.openverbs.com/v1/kev?utm_source=zero.xyz
- Price: $0.006/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/openverbs-kev-lookup-d6a070a5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_4elAN8-gl4IttjEgXKSwO

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability openverbs-kev-lookup-d6a070a5 -d '<json body>'
```

Example prompt: Can you check if CVE-2021-44228, CVE-2023-23397, and CVE-2022-30190 are in CISA's Known Exploited Vulnerabilities catalog and tell me if any of them are linked to ransomware or have a federal remediation deadline?

## When to prefer this

Use this endpoint when you need fast, authoritative lookup of whether specific CVEs have been confirmed as actively exploited by CISA — especially for patch prioritization, compliance workflows (FedRAMP, FISMA), or ransomware risk assessments. Prefer this over generic NVD lookups when you specifically need exploitation confirmation and ransomware association from a trusted government source. Best suited for batches of up to 50 CVEs per call.

## Known failure modes

- Invalid CVE format (not matching CVE-YYYY-NNNNN+ pattern) returns validation error
- Exceeding 50 CVEs per request returns a 400 error
- CVE not in KEV catalog returns a negative membership result — not an error — but does not imply the CVE is safe
- Stale data explicitly flagged when hourly refresh has not yet completed
- Service unavailability may return 5xx errors

## How this service works

Check up to 50 CVE IDs against CISA's Known Exploited Vulnerabilities (KEV) catalog. Returns membership, vendor/product, exploitation evidence, ransomware-use status and remediation guidance from CC0 data. Not listed does not mean safe or unexploited. Federal due dates are not global deadlines. Refreshed hourly; stale snapshots are explicitly flagged.

## Output

For each CVE submitted, returns whether it appears in the CISA KEV catalog, along with the affected vendor and product name, evidence of active exploitation in the wild, whether the vulnerability has been used in ransomware campaigns, and any remediation guidance or federal due dates. Stale snapshots are explicitly flagged; data refreshes hourly from CISA's CC0-licensed catalog.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "cves": {
   "type": "array",
   "items": {
    "type": "string",
    "pattern": "^[Cc][Vv][Ee]-[0-9]{4}-[0-9]{4,19}$"
   },
   "maxItems": 50,
   "minItems": 1
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/openverbs-kev-lookup-d6a070a5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from scan.openverbs.com](https://www.zero.xyz/host/scan.openverbs.com/llms.txt)