# ThreatPulse CVE Threat Intelligence Lookup

> ThreatPulse CVE Threat Intelligence Lookup is a paid API for AI agents from threatpulse.waltsoft.net, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-13).

Returns enriched threat intelligence for a given CVE, including exploit/weaponization status, CVSS score, EPSS probability, CISA KEV membership, ransomware association, and a composite urgency score aggregated from 7 correlated sources.

## Facts

- Endpoint: GET https://threatpulse.waltsoft.net/v1/cve/:id?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/threatpulse-cve-threat-intelligence-lookup-245cab89
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_P3FkPo--FsE6ldfWmAg9o

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability threatpulse-cve-threat-intelligence-lookup-245cab89
```

Example prompt: Is CVE-2024-45257 actively weaponized? Pull the full threat intel on it — I need the exploit status, EPSS score, CVSS, whether it's in the CISA KEV list, any ransomware connections, and the urgency score.

## When to prefer this

Choose ThreatPulse when you need to quickly determine whether a specific CVE is actively weaponized or exploited, especially when you want a single correlated view across CVSS, EPSS, CISA KEV, and ransomware data without querying each source separately. It is ideal for patch prioritization workflows, SOC triage, and automated vulnerability alert enrichment where a per-CVE urgency score is needed.

## Known failure modes

- Invalid CVE ID format (not matching CVE-YYYY-NNNNN pattern) returns a validation error
- CVE not found in any of the 7 correlated sources returns empty or not-found response
- Upstream threat intelligence source unavailability may result in partial data or timeout
- Very recently disclosed CVEs may have incomplete or missing enrichment data

## How this service works

Is this CVE weaponized? Returns enriched threat intelligence with exploit status, CVSS, EPSS, CISA KEV, ransomware mapping, and urgency score from 7 correlated sources.

## Output

Returns a structured threat intelligence record for the requested CVE, including: whether the CVE has been weaponized/exploited in the wild, CVSS severity score, EPSS exploitation probability, CISA KEV inclusion status, ransomware gang or campaign associations, and a composite urgency score derived from correlating 7 threat intelligence sources.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "pathParams"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "pathParams": {
     "type": "object",
     "required": [
      "id"
     ],
     "properties": {
      "id": {
       "type": "string",
       "pattern": "^CVE-\\d{4}-\\d{4,}$",
       "description": "CVE ID (e.g. CVE-2024-45257)"
      }
     }
    }
   }
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/threatpulse-cve-threat-intelligence-lookup-245cab89/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from threatpulse.waltsoft.net](https://www.zero.xyz/host/threatpulse.waltsoft.net/llms.txt)