# ThreatPulse CVE Weaponization Intelligence Feed

> ThreatPulse CVE Weaponization Intelligence Feed is a paid API for AI agents from threatpulse.waltsoft.net, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-15).

Returns enriched threat intelligence for CVEs including exploit/weaponization status, CVSS, EPSS, CISA KEV membership, ransomware mapping, and urgency score correlated from 7 sources.

## Facts

- Endpoint: GET https://threatpulse.waltsoft.net/v1/feed/critical
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/threatpulse-waltsoft-net-bae69cd9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_mdPoAtB_SkNPtyzEypyFd

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability threatpulse-waltsoft-net-bae69cd9
```

Example prompt: Check if CVE-2024-12345 is actively weaponized — I need the exploit status, CISA KEV membership, ransomware associations, CVSS and EPSS scores, and the overall urgency score from ThreatPulse's correlated 7-source feed.

## When to prefer this

Use this endpoint when you need to quickly triage and prioritize a CVE based on real-world weaponization signals rather than just CVSS severity alone. Ideal for security operations, patch prioritization workflows, and automated vulnerability management pipelines where knowing whether a CVE is actively exploited or ransomware-linked changes response urgency. Prefer over raw NVD lookups when you need correlated multi-source intelligence in a single call.

## Known failure modes

- CVE not found or not yet indexed — returns empty or 404 response
- Invalid CVE format in query — returns 400 bad request
- Payment not completed (x402 protocol) — returns 402 Payment Required
- Rate limit exceeded — returns 429
- Upstream threat intel source unavailable — may return partial data or 503

## How this service works

Is this CVE weaponized? Returns enriched threat intelligence with exploit status, CVSS, EPSS, CISA KEV, ransomware mapping, and urgency score from 7 correlated sources.

## Output

Returns enriched threat intelligence including whether the CVE has a known exploit or is actively weaponized, its CVSS base score, EPSS probability score, CISA KEV inclusion status, any ransomware campaign associations, and a composite urgency score aggregated from 7 correlated threat intelligence sources.

## Example request

```json
{
 "id": "CVE-2024-45257"
}
```

## Request schema (JSON Schema)

```json
{
 "required": [
  "id"
 ],
 "properties": {
  "id": {
   "type": "string",
   "description": "CVE ID (e.g. CVE-2024-45257)"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/threatpulse-waltsoft-net-bae69cd9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from threatpulse.waltsoft.net](https://www.zero.xyz/host/threatpulse.waltsoft.net/llms.txt)