# Stack Facts CISA KEV CVE Lookup

> Stack Facts CISA KEV CVE Lookup is a paid API for AI agents from g5joilnmeep4ntz3nwezxt5dmu.srv.us, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-13).

Looks up a CVE identifier against the CISA Known Exploited Vulnerabilities (KEV) catalog and returns exploitation status, vendor/product info, due dates, ransomware association, and cryptographically signed metadata.

## Facts

- Endpoint: GET https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/kev/%7Bcve%7D?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/stack-facts-cisa-kev-cve-lookup-79fa3f68
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_YXI9VyMBKgB9rEW0hslFi

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability stack-facts-cisa-kev-cve-lookup-79fa3f68
```

Example prompt: Before we deploy this update, check if CVE-2021-44228 is on the CISA Known Exploited Vulnerabilities list — I need to know if it's been exploited in ransomware attacks and what the required patching deadline is.

## When to prefer this

Choose this endpoint when you need authoritative, cryptographically signed confirmation of whether a specific CVE has been flagged by CISA as actively exploited — especially for compliance workflows (BOD 22-01), pre-deployment security checks, or SOC alert enrichment. It is preferable to raw CISA feeds when you need a pay-per-call model with no account setup, signed responses for audit trails, and normalized structured data. Use over generic CVE databases (NVD, OSV) when exploitation status and ransomware association are the primary concern.

## Known failure modes

- CVE not found in KEV catalog — returns in_kev: false rather than an error
- Invalid CVE format may return a 400 or empty result
- Stale data flag (meta.stale: true) if the snapshot is outdated
- Payment failure (402) if USDC balance is insufficient
- Network timeout if the server is temporarily unavailable

## How this service works

Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.

## Output

Returns a JSON object with: whether the CVE is in the KEV catalog (in_kev boolean), CVE ID, vulnerability name, vendor, product, date added to KEV, remediation due date, required action text, ransomware association flag, notes URLs, catalog version, and a full signed metadata block including sha256 hash, cryptographic signature, source URL, dataset label, license (CC0-1.0), snapshot ID, and staleness indicator.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "properties": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "cve": "CVE-2021-44228",
   "name": "Apache Log4j2 Remote Code Execu…",
   "in_kev": true,
   "vendor": "Apache",
   "product": "Log4j2",
   "due_date": "2021-12-24",
   "date_added": "2021-12-10",
   "notes_urls": [
    "https://nvd.nist.gov/vuln/detai…"
   ],
   "catalog_version": "2026.10.10",
   "required_action": "For all affected software asset…",
   "known_ransomware": true
  },
  "meta": {
   "as_of": "2026-10-09T06:00:00Z",
   "stale": false,
   "key_id": "sf-test-1",
   "notice": "Normalised (modified) from the …",
   "sha256": "f4586cc54bee30640f4364100eb70b7…",
   "source": "https://www.cisa.gov/sites/defa…",
   "dataset": "kev",
   "licence": "CC0-1.0",
   "signature": "Tne7KlsSRbohZK45rjItkYBKFOd8sEd…",
   "attribution": "Source: CISA Known Exploited Vu…",
   "snapshot_id": "kev-20261009T060000Z-f4586cc5",
   "manifest_url": "/v1/kev/manifest",
   "retrieved_at": "2026-10-09T06:00:00.000Z"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/stack-facts-cisa-kev-cve-lookup-79fa3f68/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from g5joilnmeep4ntz3nwezxt5dmu.srv.us](https://www.zero.xyz/host/g5joilnmeep4ntz3nwezxt5dmu.srv.us/llms.txt)