# P0 CVE Vulnerability Lookup > P0 CVE Vulnerability Lookup is a paid API for AI agents from x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-30). Retrieves detailed CVE vulnerability records including CVSS scores, EPSS probability, KEV catalog status, and CWE identifiers for a given CVE ID ## Facts - Endpoint: GET https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/vuln/cve?utm_source=zero.xyz - Price: $0.005/call - Payment: x402 - Status: unknown - Last checked: 2026-10-30 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/p0-cve-vulnerability-lookup-8be66081 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_zWDfwUwFYN8M2cl6xUddy Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability p0-cve-vulnerability-lookup-8be66081 ``` Example prompt: What are the full details for CVE-2021-44228 — give me the CVSS score, severity, whether it's in the CISA KEV catalog, and the current EPSS exploitation probability. ## When to prefer this Use this endpoint when you need a single unified vulnerability record combining CVE.org, NVD, FIRST EPSS, and CISA KEV data in one call rather than querying each source separately. Prefer this when you specifically need EPSS exploitation probability alongside CVSS scores and KEV status. It is ideal for automated security triage pipelines, agent-driven patch prioritization, or enriching SBOMs and vulnerability reports with authoritative scoring data. Not suitable for bulk CVE scanning (single CVE per call) or when you need L402-gated vulnerability feeds. ## Known failure modes - Invalid CVE ID format (must match CVE-YYYY-NNNNN pattern) returns a validation error - CVE ID not found in the index returns a 404 or empty result - NVD API unavailable causes fallback to CVE.org-only scores, which may omit NVD primary scores - EPSS score absent when FIRST has not yet scored the CVE (epss field is null) - KEV listed:false means not in the catalog, not an error - Payment of $0.005 USDC required per call; missing or invalid x402 payment header causes 402 response ## How this service works An open index of the machine-to-machine (agent) economy. x402 routes: ranked discovery over the live x402 service market, every indexed service scored by real 30-day calls and paying-wallet bounds, with a receipt naming the snapshot hash and scoring revision. /economy routes, for Tempo MPP, Virtuals ACP, Olas, Masumi, ERC-8004 agent registries, Solana agent registries, Base agent contracts and MCP servers (Official MCP Registry): each protocol's published figures (agent or server counts, transactions or payment events; payers and USD volume only where the source publishes them: payers for x402 and Tempo MPP, USD volume for x402 and Virtuals ACP), each with its unit, window and source; units differ, so totals are not summed. L402 listings are not covered. ## Output A structured JSON record containing: CVE ID, CVSS headline score (version, base score, severity, vector, provider), full list of CVSS scores from all providers, EPSS exploitation probability with 30-day series, CISA KEV catalog entry (listed status, vendor, product, due date, ransomware use), CWE identifiers, published date, CVE state, NVD status, references with tags, source URLs, attribution, and an as_of timestamp indicating data freshness. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET", "HEAD" ], "type": "string" }, "queryParams": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "pattern": "^CVE-\\d{4}-\\d{4,19}$", "description": "CVE identifier, e.g. CVE-2021-44228" } } } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object", "required": [ "id", "description", "cvss", "cvss_scores", "published", "cwe", "references", "epss", "kev", "kev_catalog", "as_of", "source", "source_url", "attribution", "note" ], "properties": { "id": { "type": "string" }, "cwe": { "type": "array", "items": { "type": "string" }, "description": "CWE ids" }, "kev": { "type": "object", "required": [ "listed" ], "properties": { "name": { "type": [ "string", "null" ] }, "listed": { "type": "boolean" }, "vendor": { "type": [ "string", "null" ] }, "product": { "type": [ "string", "null" ] }, "due_date": { "type": [ "string", "null" ] }, "date_added": { "type": [ "string", "null" ] }, "required_action": { "type": [ "string", "null" ] }, "known_ransomware_use": { "type": "string", "description": "Known or Unknown (CISA field)" } } }, "cvss": { "anyOf": [ { "type": "object", "required": [ "version", "base_score", "provider" ], "properties": { "vector": { "typ … (truncated) ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "id": "CVE-2021-44228", "cwe": [ "CWE-20" ], "kev": { "name": "Apache Log4j2 Remote Code Execution Vulnerability", "listed": true, "vendor": "Apache", "product": "Log4j2", "due_date": "2021-12-24", "date_added": "2021-12-10", "required_action": "Apply updates per vendor instructions.", "known_ransomware_use": "Known" }, "cvss": { "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "primary": true, "version": "3.1", "provider": "NVD", "severity": "CRITICAL", "base_score": 10 }, "epss": { "date": "2026-10-25", "score": 0.99999, "change_7d": 0, "percentile": 1, "series_30d": [ { "date": "2026-10-24", "score": 0.99999, "percentile": 1 } ], "change_7d_from": "2026-10-18" }, "note": "Facts as returned by the sources, read at as_of; not remediation advice and not a risk score for your systems. cvss is the headline score: CVSS v3.x before v4.0 before v2, within a version NVD primary, then the CNA, then other NVD sources, then CISA ADP; every score the sources gave is in cvss_scores with its provider. NVD is optional: when it does not answer, scores come from the CVE.org record. epss is null when FIRST has not scored the CVE yet. KEV is the CISA catalog (kev.listed false means not in the catalog at kev_catalog.released).", "as_of": "2026-10-25T09:00:00.000Z", "source": "CVE.org + NVD + FIRST EPSS + CISA KEV", "severity": "CRITICAL", "cve_state": "PUBLISHED", "published": "2021-12-10T10:15:09.143Z", "nvd_status": "Analyzed", "references": [ { "url": "https://logging.apache.org/log4j/2.x/security.html", "tags": [ "Vendor Advisory" ] } ], "source_url": "https://www.cve.org/CVERecord?id=CVE-2021-44228", "attribution": "CVE® record, Copyright © 1999-2026, The MITRE Corporation. Used under the CVE Program license (perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, sublicense and distribute CVE): https://www.cve.org/Legal/TermsOfUse This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS scores by FIRST / Empirical Security (https://www.first.org/epss/), free of charge. CISA Known Exploited Vulnerabilities Catalog, CC0 1.0; not an endorsement by CISA or DHS.", "cvss_scores": [ { "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "p … (truncated) ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/p0-cve-vulnerability-lookup-8be66081/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev](https://www.zero.xyz/host/x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/llms.txt)