# Vextorium CVE/Vulnerability Info Lookup

> Vextorium CVE/Vulnerability Info Lookup is a paid API for AI agents from api.vextorium.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-27).

Returns detailed vulnerability data for a given CVE, GHSA, or PYSEC identifier, including severity, CVSS vector, affected packages, fixed versions, and references, sourced from OSV.dev.

## Facts

- Endpoint: POST https://api.vextorium.com/v1/cve-info?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-27
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/vextorium-cve-vulnerability-info-lookup-2b2e6500
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_U-cVsS-UgIn5xci1H-7P4

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability vextorium-cve-vulnerability-info-lookup-2b2e6500 -d '<json body>'
```

Example prompt: Can you pull up the full vulnerability details for CVE-2021-44228 — I need the CVSS score, severity, affected packages, fixed versions, and any relevant references?

## When to prefer this

Use this endpoint when you need structured, machine-readable vulnerability details for a specific CVE, GHSA, or PYSEC identifier and want OSV.dev-sourced data including CVSS vectors, affected packages, and fixed versions. Prefer this over general web search when you need reliable, normalized advisory data for automated security workflows, dependency audits, or vulnerability triage pipelines.

## Known failure modes

- Unknown or invalid identifier returns null or empty result
- Identifier format not recognized (e.g. malformed CVE string) may return an error
- OSV.dev upstream data lag may mean very recent CVEs have incomplete or missing entries
- Some fields (severity, summary, package ecosystem) may be null if OSV.dev lacks that data
- Network or upstream timeout may cause request failure

## How this service works

244 pay-per-call data APIs for AI agents: official statistics and economy (ECB, Fed, Eurostat, World Bank, SEC, BOE, INE), crypto prices and sentiment, Spanish public data, compliance (sanctions, VAT, IBAN, LEI), science, weather, web and developer tools and local AI text tools. Pay in USDC via x402.

## Output

A JSON object containing the vulnerability ID, aliases (e.g. GHSA/CVE cross-references), CVSS vector strings, severity rating, a textual description, publication and modification timestamps, a list of affected packages with their ecosystems and corrected commit hashes or versions, and an array of external reference URLs. Data is sourced from OSV.dev under CC BY 4.0.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "identifier": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "id": "CVE-2021-44228",
  "cvss": [
   "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  ],
  "title": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints",
  "source": "CVE® (MITRE), from the official CVE Services API.",
  "status": "PUBLISHED",
  "license": "Copyright © 1999-2026, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation. License: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly di…",
  "affected": [
   {
    "product": "Apache Log4j2",
    "provider": "Apache Software Foundation",
    "versions": [
     "2.0-beta9 < log4j-core*"
    ]
   }
  ],
  "modified": "2025-10-21T23:25:23.121Z",
  "severity": "CRITICAL",
  "published": "2021-12-10T00:00:00.000Z",
  "references": [
   "https://logging.apache.org/log4j/2.x/security.html",
   "http://www.openwall.com/lists/oss-security/2021/12/10/1"
  ],
  "description": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message p…"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/vextorium-cve-vulnerability-info-lookup-2b2e6500/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.vextorium.com](https://www.zero.xyz/host/api.vextorium.com/llms.txt)