# Vextorium CISA KEV Exploited Vulnerabilities Lookup

> Vextorium CISA KEV Exploited Vulnerabilities Lookup is a paid API for AI agents from api.vextorium.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-16).

Returns vulnerabilities actively exploited in the wild from CISA's Known Exploited Vulnerabilities (KEV) catalog, filterable by recency, keyword, and ransomware association

## Facts

- Endpoint: POST https://api.vextorium.com/vulnerabilidades-explotadas-pago?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/vextorium-cisa-kev-exploited-vulnerabilities-lookup-bc444aab
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_3Lm9P9Psp_v1itqRIuqjX

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability vextorium-cisa-kev-exploited-vulnerabilities-lookup-bc444aab -d '<json body>'
```

Example prompt: Can you pull the CISA Known Exploited Vulnerabilities added in the last 14 days and filter it to only show ones associated with ransomware?

## When to prefer this

Use this endpoint when you need up-to-date, authoritative data on vulnerabilities that are actively being exploited in the wild, sourced directly from CISA's KEV catalog. It is ideal for security operations, patch prioritization workflows, ransomware exposure assessments, and compliance monitoring. Prefer it over generic CVE databases (e.g., NVD) when you specifically need confirmed exploitation status and remediation deadlines as designated by CISA.

## Known failure modes

- Empty result set if keyword search matches no KEV entries
- Invalid or missing body fields may return a 400 error
- CISA catalog data may have a short lag behind official KEV updates
- Filtering by both dias and buscar simultaneously may narrow results unexpectedly
- Payment failure via x402 protocol returns 402 before any data is returned

## How this service works

Vulnerabilities being actively exploited according to CISA's KEV catalog: CVE, vendor, product, name, description, date added, remediation due date and ransomware use; the latest N days or search by vendor/product (Microsoft, Cisco, Fortinet...).

## Output

Returns a JSON object with the data source, catalog name, total catalog count, number of matches, and an array of vulnerability records each containing CVE ID, CWE list, vendor, product, vulnerability name, description, date added, remediation due date, required action, and ransomware association status.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "dias": {
   "type": "integer"
  },
  "buscar": {
   "type": "string"
  },
  "limite": {
   "type": "integer"
  },
  "ransomware": {
   "type": "boolean"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/vextorium-cisa-kev-exploited-vulnerabilities-lookup-bc444aab/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.vextorium.com](https://www.zero.xyz/host/api.vextorium.com/llms.txt)