# ThreatPulse CVE Threat Intelligence Lookup

> ThreatPulse CVE Threat Intelligence Lookup is a paid API for AI agents from threatpulse.waltsoft.net, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-15).

Returns enriched threat intelligence for a given CVE, including exploit weaponization status, CVSS score, EPSS probability, CISA KEV membership, ransomware associations, and an urgency score correlated from 7 sources.

## Facts

- Endpoint: GET https://threatpulse.waltsoft.net/v1/cve/CVE-2024-45257
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/threatpulse-waltsoft-net-2e7e2e32
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_zIcsI2--4mMxUbwNuaj9t

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability threatpulse-waltsoft-net-2e7e2e32
```

Example prompt: Is CVE-2024-45257 weaponized? I need to know if it's in CISA KEV, its EPSS score, whether it's been tied to ransomware, and what urgency score ThreatPulse gives it so I can decide whether to emergency-patch our systems.

## When to prefer this

Use this endpoint when you need rapid, multi-source CVE threat intelligence enrichment in a single call — especially to determine whether a vulnerability is actively exploited, ransomware-linked, or CISA-prioritized. Prefer this over raw NVD or NIST queries when you need weaponization status and urgency scoring beyond just CVSS. Ideal for automated patch prioritization workflows, SOC triage, and vulnerability management pipelines.

## Known failure modes

- CVE ID not found or not yet indexed — returns 404 or empty result
- Malformed CVE identifier (e.g. missing year or sequence) — returns 400 validation error
- Payment not included or insufficient — returns 402 Payment Required
- Rate limiting if too many requests — returns 429
- Upstream intelligence source unavailable — may return partial data or 503

## How this service works

Is this CVE weaponized? Returns enriched threat intelligence with exploit status, CVSS, EPSS, CISA KEV, ransomware mapping, and urgency score from 7 correlated sources.

## Output

A JSON object containing: whether the CVE has a known working exploit (weaponization status), CVSS base score, EPSS exploitation probability score, CISA KEV inclusion flag, ransomware gang associations, an urgency/priority score, and metadata correlated from 7 threat intelligence sources.

## Example request

```json
{
 "id": "CVE-2024-45257"
}
```

## Request schema (JSON Schema)

```json
{
 "required": [
  "id"
 ],
 "properties": {
  "id": {
   "type": "string",
   "description": "CVE ID (e.g. CVE-2024-45257)"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/threatpulse-waltsoft-net-2e7e2e32/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from threatpulse.waltsoft.net](https://www.zero.xyz/host/threatpulse.waltsoft.net/llms.txt)