# Vulnerability Intelligence – CVE Patch Priority (P0–P3)

> Vulnerability Intelligence – CVE Patch Priority (P0–P3) is a paid API for AI agents from vuln-intel.x402tookit.com, paid per call via x402, $0.03/call, status unknown (last checked 2026-10-21).

Returns a P0–P3 patch priority verdict for a single CVE by combining CISA KEV exploitation status, EPSS exploit probability, and advisory severity.

## Facts

- Endpoint: GET https://vuln-intel.x402tookit.com/vuln-cve?utm_source=zero.xyz
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/vulnerability-intelligence-cve-patch-priority-p0-p3-f7454019
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_fOSLN9DcZvDEdIEZCkEsN

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability vulnerability-intelligence-cve-patch-priority-p0-p3-f7454019
```

Example prompt: What patch priority should I assign to CVE-2021-44228 — is it being actively exploited in the wild and what's the EPSS exploit probability?

## When to prefer this

Choose this endpoint when you need a single, actionable patch priority decision (P0–P3) for a specific CVE, combining CISA KEV exploitation evidence, EPSS probability, and advisory severity into one verdict — rather than looking up each signal separately. Ideal for vulnerability triage workflows, security automation pipelines, or when a human needs a clear 'how urgent is this?' answer backed by authoritative data sources.

## Known failure modes

- Invalid or malformed CVE ID returns an error or null verdict
- CVE not found in any data source returns a low-confidence or degraded result
- Upstream EPSS or CISA KEV data temporarily unavailable triggers degraded mode with partial results
- Rate limiting or payment failure returns HTTP 402
- Very new CVEs may not yet have EPSS scores or advisory data, resulting in incomplete signals

## How this service works

Patch priority P0-P3 for a CVE from CISA exploited-in-the-wild status, EPSS exploit probability and advisory severity.

## Output

A structured JSON object containing: a P0–P3 patch priority verdict, the list of reasons behind the verdict, a human-readable summary, EPSS exploit probability and percentile, CISA KEV record (if present) including vendor, product, date added, due date, ransomware use, and required action, advisory severity, source attribution, and flags for degraded data or unchecked signals.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "cve"
     ],
     "properties": {
      "cve": {
       "type": "string",
       "description": "CVE id, e.g. CVE-2021-44228"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "cve": {
       "type": [
        "null",
        "string"
       ]
      },
      "kev": {
       "type": [
        "null",
        "object"
       ],
       "properties": {
        "name": {
         "type": [
          "null",
          "string"
         ]
        },
        "vendor": {
         "type": [
          "null",
          "string"
         ]
        },
        "dueDate": {
         "type": [
          "null",
          "string"
         ]
        },
        "product": {
         "type": [
          "null",
          "string"
         ]
        },
        "dateAdded": {
         "type": [
          "null",
          "string"
         ]
        },
        "ransomwareUse": {
         "type": [
          "null",
          "string"
         ]
        },
        "requiredAction": {
         "type": [
          "null",
          "string"
         ]
        }
       }
      },
      "asOf": {
       "type": [
        "null",
        "string"
       ]
      },
      "epss": {
       "type": [
        "null",
        "object"
       ],
       "properties": {
        "asOf": {
         "type": [
          "null",
          "string"
         ]
        },
        "percentile": {
         "type": [
          "null",
          "number"
         ]
        },
        "probability": {
         "type": [
          "null",
          "number"
         ]
        }
       }
      },
      "inKev": {
       "type": [
        "boolean",
        "null"
       ]
      },
      "source": {
       "type": [
        "null",
        "string"
       ]
      },
      "reasons": {
       "type": [
        "array",
        "null"
       ],
       "items": {
   
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/vulnerability-intelligence-cve-patch-priority-p0-p3-f7454019/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from vuln-intel.x402tookit.com](https://www.zero.xyz/host/vuln-intel.x402tookit.com/llms.txt)