# Stack Facts KEV Check

> Stack Facts KEV Check is a paid API for AI agents from g5joilnmeep4ntz3nwezxt5dmu.srv.us, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-13).

Checks one or more CVE identifiers against the CISA Known Exploited Vulnerabilities (KEV) catalog, returning exploitation status, vendor/product info, due dates, and ransomware association.

## Facts

- Endpoint: POST https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/kev/check?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/stack-facts-kev-check-8cfe2b46
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ztSpoqXLTI44of9mx7qr5

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability stack-facts-kev-check-8cfe2b46 -d '<json body>'
```

Example prompt: Can you check whether CVE-2021-44228 and CVE-2023-23397 are in the CISA Known Exploited Vulnerabilities catalog and whether either is linked to ransomware?

## When to prefer this

Choose this endpoint when you need to specifically check whether CVEs are in the CISA Known Exploited Vulnerabilities catalog — a high-signal authoritative list of vulnerabilities actively exploited in the wild. It is ideal for prioritizing remediation, compliance workflows (CISA BOD 22-01), or pre-install security checks. Prefer this over general CVE databases when ransomware association and federal remediation deadlines are relevant. It requires no account or API key, uses pay-per-call USDC micropayments via x402, and returns cryptographically signed answers for auditability.

## Known failure modes

- Invalid CVE format (not matching CVE-YYYY-NNNNN pattern) causes validation error
- Empty or missing cves array returns an error
- More than 100 CVEs in a single request exceeds the maxItems limit
- CVE not present in KEV catalog returns in_kev: false (not an error)
- Payment failure via x402 protocol prevents response
- Stale catalog data indicated by meta.stale: true field
- Signature verification failure may indicate tampered response

## How this service works

Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.

## Output

Returns a JSON object with per-CVE results including whether each CVE is in the CISA KEV catalog, the vendor and product name, date added, remediation due date, known ransomware association flag, required action text, and reference URLs. Also includes metadata: catalog version, snapshot ID, data freshness timestamp, staleness flag, CC0 license attribution, and a cryptographic SHA-256 signature for answer integrity verification.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "cves": {
   "type": "array",
   "items": {
    "type": "string",
    "pattern": "^[Cc][Vv][Ee]-\\d{4}-\\d{4,}$",
    "maxLength": 32
   },
   "maxItems": 100,
   "minItems": 1
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "count": 2,
   "in_kev": 1,
   "results": [
    {
     "cve": "CVE-2021-44228",
     "name": "Apache Log4j2 Remote Code Execu…",
     "in_kev": true,
     "vendor": "Apache",
     "product": "Log4j2",
     "due_date": "2021-12-24",
     "date_added": "2021-12-10",
     "notes_urls": [
      "https://nvd.nist.gov/vuln/detai…"
     ],
     "required_action": "For all affected software asset…",
     "known_ransomware": true
    }
   ],
   "catalog_version": "2026.10.10"
  },
  "meta": {
   "as_of": "2026-10-09T06:00:00Z",
   "stale": false,
   "key_id": "sf-test-1",
   "notice": "Normalised (modified) from the …",
   "sha256": "f4586cc54bee30640f4364100eb70b7…",
   "source": "https://www.cisa.gov/sites/defa…",
   "dataset": "kev",
   "licence": "CC0-1.0",
   "signature": "Tne7KlsSRbohZK45rjItkYBKFOd8sEd…",
   "attribution": "Source: CISA Known Exploited Vu…",
   "snapshot_id": "kev-20261009T060000Z-f4586cc5",
   "manifest_url": "/v1/kev/manifest",
   "retrieved_at": "2026-10-09T06:00:00.000Z"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/stack-facts-kev-check-8cfe2b46/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from g5joilnmeep4ntz3nwezxt5dmu.srv.us](https://www.zero.xyz/host/g5joilnmeep4ntz3nwezxt5dmu.srv.us/llms.txt)