# SiteCheck Web Intel CVE Details Feed

> SiteCheck Web Intel CVE Details Feed is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-24).

Fetches CVE vulnerability trend data for a vendor (and optionally a product) from the NIST NVD, including counts by severity, CVSS scores, top weaknesses, and highest-scored CVEs over a configurable time window.

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/cve-details-feed?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-24
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-cve-details-feed-27061175
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_LioxOhBetbdRhQCDb-mf2

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-cve-details-feed-27061175
```

Example prompt: Pull the CVE vulnerability trend for Fortinet from the NIST NVD over the last 30 days — match by CPE — and show me the top 15 highest-scored CVEs along with severity counts and the most common CWE weaknesses.

## When to prefer this

Use this endpoint when you need a structured, aggregated vulnerability intelligence summary for a specific vendor or product — especially when you want severity distributions, CVSS statistics, trend rates, and ranked CVE lists in one call. Prefer it over raw NVD search when you need pre-computed analytics rather than individual CVE lookup. The CPE match mode is ideal for precise product scoping; keyword mode works better for broad vendor coverage. Not suited for real-time zero-day feeds or historical data beyond 120 days.

## Known failure modes

- Vendor name not found or misspelled — returns empty or no-match result
- NVD timeout for large vendors over long windows (30+ seconds for big vendors like Microsoft over 120 days)
- Invalid days value outside 1–120 range — may return error or default
- Invalid top value outside 1–50 range — may return error or default
- Transient NVD API unavailability causing delayed or failed response
- CPE match mode returning fewer results than keyword mode for less-catalogued vendors

## How this service works

Vulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long window can take NVD 30+ seconds) naming the vendor (or mapped to its CPE with match=cpe), counts by severity, average and maximum CVSS score, CVEs per week, top CWE weaknesses and the highest-scored CVEs with score, severity, vector, date and description.

## Output

Returns a structured summary including: total CVE count, counts broken down by severity (Critical, High, Medium, Low), average and maximum CVSS scores, CVEs-per-week rate, top CWE weakness categories, and a ranked list of the highest-scored CVEs each with score, severity, CVSS vector, publication date, and description.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "vendor"
     ],
     "properties": {
      "top": {
       "type": "string",
       "description": "How many top-scored CVEs to list, 1 to 50 (default 10)"
      },
      "days": {
       "type": "string",
       "description": "Look-back window in days, 1 to 120 (default 7)"
      },
      "match": {
       "type": "string",
       "description": "keyword (default: vendor/product words in the CVE text) or cpe (only CVEs NVD has mapped to the vendor CPE)"
      },
      "vendor": {
       "type": "string",
       "description": "CPE vendor name, e.g. microsoft, apache, cisco, fortinet (required)"
      },
      "product": {
       "type": "string",
       "description": "Optional CPE product name, e.g. windows_11_24h2, http_server, fortios"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-cve-details-feed-27061175/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)