{"uid":"cap_4elAN8-gl4IttjEgXKSwO","slug":"openverbs-kev-lookup-d6a070a5","name":"OpenVerbs KEV Lookup","description":"Check up to 50 CVE IDs against CISA's Known Exploited Vulnerabilities (KEV) catalog. Returns membership, vendor/product, exploitation evidence, ransomware-use status and remediation guidance from CC0 data. Not listed does not mean safe or unexploited. Federal due dates are not global deadlines. Refreshed hourly; stale snapshots are explicitly flagged.","url":"https://scan.openverbs.com/v1/kev?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"cves":{"type":"array","items":{"type":"string","pattern":"^[Cc][Vv][Ee]-[0-9]{4}-[0-9]{4,19}$"},"maxItems":50,"minItems":1}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.006","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.006/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.006","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.006","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_HBX8CYxnGG_Iboa2o4qAI","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.006","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Check up to 50 CVE IDs against CISA's Known Exploited Vulnerabilities catalog, returning membership status, vendor/product info, exploitation evidence, ransomware association, and remediation guidance","exampleAgentPrompt":"Can you check if CVE-2021-44228, CVE-2023-23397, and CVE-2022-30190 are in CISA's Known Exploited Vulnerabilities catalog and tell me if any of them are linked to ransomware or have a federal remediation deadline?","exampleUseCases":[{"title":"Patch prioritization for security team","prompt":"I have a list of 10 CVEs from our latest vulnerability scan — CVE-2021-44228, CVE-2022-26134, CVE-2023-23397, CVE-2022-30190, CVE-2021-26084, CVE-2020-1472, CVE-2021-34527, CVE-2022-22965, CVE-2023-20198, CVE-2021-21985. Can you check which ones are in CISA's KEV catalog so I know which to prioritize patching first?"},{"title":"Ransomware risk check for vendor CVEs","prompt":"We just got a vendor security advisory mentioning CVE-2023-27350 and CVE-2023-4966. Can you check CISA's KEV catalog for both and let me know if either is associated with ransomware attacks?"},{"title":"Compliance audit CVE verification","prompt":"For our FedRAMP compliance review, I need to know if CVE-2022-1388, CVE-2021-26855, and CVE-2021-27065 appear in CISA's Known Exploited Vulnerabilities list and whether there are any federal remediation due dates we need to meet."}],"resultDescription":"For each CVE submitted, returns whether it appears in the CISA KEV catalog, along with the affected vendor and product name, evidence of active exploitation in the wild, whether the vulnerability has been used in ransomware campaigns, and any remediation guidance or federal due dates. Stale snapshots are explicitly flagged; data refreshes hourly from CISA's CC0-licensed catalog.","failureModes":["Invalid CVE format (not matching CVE-YYYY-NNNNN+ pattern) returns validation error","Exceeding 50 CVEs per request returns a 400 error","CVE not in KEV catalog returns a negative membership result — not an error — but does not imply the CVE is safe","Stale data explicitly flagged when hourly refresh has not yet completed","Service unavailability may return 5xx errors"],"whenToPreferThis":"Use this endpoint when you need fast, authoritative lookup of whether specific CVEs have been confirmed as actively exploited by CISA — especially for patch prioritization, compliance workflows (FedRAMP, FISMA), or ransomware risk assessments. Prefer this over generic NVD lookups when you specifically need exploitation confirmation and ransomware association from a trusted government source. Best suited for batches of up to 50 CVEs per call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T12:34:34.161Z","isFirstParty":false,"canonicalSlug":"openverbs-kev-lookup-d6a070a5"}