{"uid":"cap_5ghUrHLK1pdQRqa_jdp2i","slug":"epss-exploit-score-lookup-c7ca92d6","name":"EPSS Exploit Score Lookup","description":"EPSS (Exploit Prediction Scoring System) for one CVE from FIRST's public API: the estimated probability (0 to 1) of exploitation in the next 30 days, its percentile among all scored CVEs and the scoring date. EPSS predicts; it does not say an exploit exists (see cisa-known-exploits).","url":"https://api.webintel-api.workers.dev/api/security/epss-exploit-score?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["cveId"],"properties":{"cveId":{"type":"string","description":"CVE identifier such as CVE-2021-44228 (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"date":"2026-10-22","epss":0.99999,"cveId":"CVE-2021-44228","scored":true,"source":"https://api.first.org/data/v1/epss?cve=CVE-2021-44228","checkedAt":"2026-10-23T09:38:39.115Z","percentile":1}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_PLk6Tr7VuSah9Wy1uA3oe","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns the FIRST EPSS probability score, percentile, and scoring date for a given CVE, estimating the likelihood of exploitation in the next 30 days.","exampleAgentPrompt":"What's the EPSS exploitation probability score and percentile for CVE-2021-44228 — I want to know how likely it is to be actively exploited in the next 30 days?","exampleUseCases":[{"title":"Triage high-priority CVE patches","prompt":"We just got an alert about CVE-2023-44487 — can you pull the EPSS score to tell me how likely it is to be exploited in the next 30 days and what percentile it falls in among all scored CVEs?"},{"title":"Automate vulnerability risk enrichment","prompt":"For CVE-2024-3094, what does FIRST's EPSS model say about its exploitation probability? I need the score, percentile, and when it was last scored so I can prioritize our remediation queue."},{"title":"Evaluate Log4Shell ongoing risk","prompt":"Check the current EPSS exploitation prediction score for CVE-2021-44228 — is it still scoring near the top percentile compared to all other CVEs?"}],"resultDescription":"Returns a JSON object containing the CVE ID, EPSS probability score (0 to 1 representing likelihood of exploitation in the next 30 days), the CVE's percentile rank among all EPSS-scored CVEs, the date the score was calculated, a boolean indicating whether the CVE was scored, a link to the source FIRST API response, and the timestamp when the check was performed.","failureModes":["CVE ID not found in EPSS database — returns scored: false","Malformed CVE ID format causes query failure","FIRST upstream API unavailable or rate-limited","CVE is too new to have an EPSS score yet","Network timeout to upstream FIRST API"],"whenToPreferThis":"Use this endpoint when you need a probabilistic, forward-looking exploitation likelihood score from FIRST's EPSS model for a specific CVE. Prefer this over CISA Known Exploits when you want a predicted risk score rather than confirmation of active exploitation. Ideal for prioritizing patch queues and enriching vulnerability reports with exploitation probability data.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-24T12:35:14.207Z","isFirstParty":false,"canonicalSlug":"epss-exploit-score-lookup-c7ca92d6"}