{"uid":"cap_YBclFoSshCqO0HroVXrQh","slug":"cve-genexxis-com-package-vulnerability-scanner-80fc8f7e","name":"cve.genexxis.com Package Vulnerability Scanner","description":"Vulnerability intelligence for triage agents. /cve looks up a CVE id or searches NVD by keyword (same params as other CVE APIs: id or keyword, severity, maxItems, plus days) and returns CVSS v3.1 and v4.0 scores and vectors, CWE, affected CPE products, references, plus the CISA Known Exploited Vulnerabilities status (date added, due date, ransomware use, required action), the FIRST EPSS exploitation probability and percentile, and a one-line patch priority. /kev lists the latest actively exploited CVEs with EPSS. /packages scans up to 50 open-source dependencies (npm, PyPI, Maven, Go, crates.io, NuGet, RubyGems, ...) against OSV.dev with fixed versions and KEV/EPSS joined. NVD live (cached 1 h), KEV and EPSS refreshed every 6 h.","url":"https://cve.genexxis.com/packages?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"packages":{"type":"array","description":"Up to 50 items {ecosystem (npm, PyPI, Maven, Go, crates.io, NuGet, RubyGems, Packagist, ...), name, version (optional)}"}}},"responseSchema":{"type":"json","example":{"asOf":"2026-10-25T03:40:00.000Z","inKev":0,"source":"OSV.dev + CISA KEV + FIRST EPSS","results":[{"name":"lodash","count":5,"inKev":false,"version":"4.17.15","ecosystem":"npm","vulnerable":true,"maxSeverity":"HIGH","vulnerabilities":[{"id":"GHSA-p6mc-m468-83gw","kev":null,"cves":["CVE-2020-8203"],"cvss":{"score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},"epss":{"score":0.04,"percentile":0.88},"aliases":["CVE-2020-8203"],"fixedIn":["4.17.19"],"summary":"Prototype Pollution in lodash","severity":"HIGH"}],"suggestedMinimumVersion":"4.17.21"}],"totalVulns":9,"packagesScanned":2,"vulnerablePackages":2}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm__p-R0o-uhzS_ijOAfweLM","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans up to 50 open-source packages against OSV.dev and enriches results with CISA KEV and EPSS scores, returning advisory details, CVSS scores, fixed versions, and a suggested minimum safe version.","exampleAgentPrompt":"Can you scan these npm packages for known vulnerabilities: lodash 4.17.15, axios 0.21.1, and express 4.17.1 — and tell me their CVSS scores, whether any are in the CISA KEV list, their EPSS exploit probability, and what the minimum safe version is for each?","exampleUseCases":[{"title":"Pre-release dependency security audit","prompt":"Before we ship this release, scan these 5 packages for CVEs: PyPI django 3.2.0, PyPI requests 2.25.0, npm moment 2.29.1, Go golang.org/x/net 0.0.0-20210405180319-a5a99cb37ef4, and crates.io tokio 1.8.0 — I need CVSS scores, EPSS percentile, whether any are actively exploited in the wild, and what versions we should upgrade to."},{"title":"CI pipeline vulnerability gate","prompt":"We're running a security gate in our CI pipeline — can you check if any of these Maven packages are critically vulnerable: org.apache.logging.log4j:log4j-core 2.14.1, com.fasterxml.jackson.core:jackson-databind 2.12.3, and org.springframework:spring-core 5.3.8? Flag anything in CISA KEV immediately."},{"title":"Triaging exploited package exposure","prompt":"I just heard log4shell is actively exploited — can you check org.apache.logging.log4j:log4j-core versions 2.14.0 and 2.14.1 on Maven to see if they're in the CISA KEV list, what the EPSS score is, what fixed versions exist, and what the minimum safe version I should upgrade to is?"}],"resultDescription":"Returns a JSON object with a timestamp, source attribution, per-package results including vulnerability count, maximum severity, individual advisory details (advisory ID, CVE aliases, CVSS score and vector, EPSS score and percentile, CISA KEV status, fixed versions, and summary), a suggested minimum safe version per package, and aggregate totals for packages scanned, vulnerable packages, and total vulnerabilities found.","failureModes":["More than 50 packages submitted — request rejected or truncated","Unknown or unsupported ecosystem name — package skipped or error returned","Package name or version not found in OSV.dev — returns no vulnerabilities (not an error)","OSV.dev upstream unavailable — service may return error or stale data","Malformed package entries missing required ecosystem or name fields — validation error","Network timeout on EPSS or KEV enrichment — partial results may be returned without enrichment data"],"whenToPreferThis":"Choose this endpoint when you need bulk vulnerability scanning of multiple open-source packages across different ecosystems in a single call, especially when you need CISA KEV and EPSS enrichment alongside CVSS scores and upgrade recommendations. It is ideal for CI/CD security gates, dependency audits, and supply chain risk assessments where OSV.dev advisory data enriched with real-world exploitability signals is required. Prefer this over single-CVE lookup endpoints when starting from a package list rather than a known CVE ID.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T12:31:07.153Z","isFirstParty":false,"canonicalSlug":"cve-genexxis-com-package-vulnerability-scanner-80fc8f7e"}