{"uid":"cap_9M1NOB_M-h2mX9eFUAG1h","slug":"vulnerability-intelligence-package-version-cve-lookup-c60ad6c7","name":"Vulnerability Intelligence – Package Version CVE Lookup","description":"Known vulnerabilities for an exact package version (npm, PyPI, Go, Maven...): fixed version, exploited-in-the-wild flag.","url":"https://vuln-intel.x402tookit.com/vuln-package?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ecosystem","name","version"],"properties":{"name":{"type":"string","description":"Package name, e.g. lodash"},"version":{"type":"string","description":"Exact version, e.g. 4.17.15"},"ecosystem":{"type":"string","description":"npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, Packagist, Pub or Hex"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"top":{"type":["array","null"],"items":{"type":"object","properties":{"id":{"type":["null","string"]},"cves":{"type":["array","null"],"items":{"type":"string"}},"fixedIn":{"type":["array","null"],"items":{"type":"string"}},"summary":{"type":["null","string"]},"severity":{"type":["null","string"]},"published":{"type":["null","string"]}}}},"asOf":{"type":["null","string"]},"source":{"type":["null","string"]},"package":{"type":["null","string"]},"reasons":{"type":["array","null"],"items":{"type":"string"}},"summary":{"type":["null","string"]},"verdict":{"type":["null","string"]},"degraded":{"type":["boolean","null"]},"sourceUrl":{"type":["null","string"]},"advisories":{"type":["null","number"]},"disclaimer":{"type":["null","string"]},"notChecked":{"type":["array","null"],"items":{"type":"string"}},"worstSeverity":{"type":["null","string"]},"upgradeToAtLeast":{"type":["null","string"]},"exploitedInTheWild":{"type":["array","null"]},"fixedVersionsListed":{"type":["array","null"],"items":{"type":"string"}}}}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_HLppSzvXgAxfv7TTjHWXi","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns known vulnerabilities, fixed versions, severity, and exploited-in-the-wild status for an exact package version across major ecosystems.","exampleAgentPrompt":"Check if lodash version 4.17.15 on npm has any known vulnerabilities — I need the CVE IDs, severity, fixed versions, and whether any of them are being actively exploited in the wild.","exampleUseCases":[{"title":"CI/CD dependency security gate","prompt":"Before we merge this PR, check whether PyPI package requests version 2.25.0 has any known vulnerabilities, how severe they are, and what version we'd need to upgrade to in order to be safe."},{"title":"Incident response triage","prompt":"We're running log4j version 2.14.1 on Maven — can you pull up all known CVEs for it, flag any that are exploited in the wild, and tell me the earliest fixed version I should upgrade to?"},{"title":"Open source audit for compliance","prompt":"Our app depends on npm package minimist at version 1.2.5 — does it have any known security advisories? I need the CVE IDs, worst severity, and whether there's a patched version available."}],"resultDescription":"Returns a structured vulnerability report including: list of advisories with CVE IDs, severity levels, published dates, fix versions, and summary; an overall verdict and worst-severity rating; an upgrade-to-at-least recommendation; an exploited-in-the-wild indicator; total advisory count; data source and timestamp; and any ecosystems or checks that could not be completed (degraded/notChecked flags).","failureModes":["Unknown ecosystem value returns an error or empty result","Exact version string mismatch causes no advisories found even if vulnerability exists","Package name typo returns empty result with no advisories","Upstream vulnerability database temporarily unavailable may return degraded=true with partial results","Very new or obscure packages may have no advisory data available","Non-exact version strings (ranges, wildcards) may not be supported"],"whenToPreferThis":"Use this endpoint when you need vulnerability data for a single, precisely known package name and version in a supported ecosystem (npm, PyPI, Go, Maven, NuGet, etc.). It is ideal for per-dependency checks in CI/CD pipelines, security audits, or incident triage where you already know the exact version pinned. Prefer the batch endpoint (up to 10 packages at once) for scanning full dependency lists. Use the GHSA/CVE advisory lookup sibling if you already have a specific advisory ID rather than a package version.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-21T07:19:29.895Z","isFirstParty":false,"canonicalSlug":"vulnerability-intelligence-package-version-cve-lookup-c60ad6c7"}