{"uid":"cap_YXI9VyMBKgB9rEW0hslFi","slug":"stack-facts-cisa-kev-cve-lookup-79fa3f68","name":"Stack Facts CISA KEV CVE Lookup","description":"Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.","url":"https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/kev/%7Bcve%7D?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","properties":{"properties":{"type":"string"}}},"responseSchema":{"type":"json","example":{"data":{"cve":"CVE-2021-44228","name":"Apache Log4j2 Remote Code Execu…","in_kev":true,"vendor":"Apache","product":"Log4j2","due_date":"2021-12-24","date_added":"2021-12-10","notes_urls":["https://nvd.nist.gov/vuln/detai…"],"catalog_version":"2026.10.10","required_action":"For all affected software asset…","known_ransomware":true},"meta":{"as_of":"2026-10-09T06:00:00Z","stale":false,"key_id":"sf-test-1","notice":"Normalised (modified) from the …","sha256":"f4586cc54bee30640f4364100eb70b7…","source":"https://www.cisa.gov/sites/defa…","dataset":"kev","licence":"CC0-1.0","signature":"Tne7KlsSRbohZK45rjItkYBKFOd8sEd…","attribution":"Source: CISA Known Exploited Vu…","snapshot_id":"kev-20261009T060000Z-f4586cc5","manifest_url":"/v1/kev/manifest","retrieved_at":"2026-10-09T06:00:00.000Z"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_9nIQ-wFfCnfuTPaNP1auk","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Looks up a CVE identifier against the CISA Known Exploited Vulnerabilities (KEV) catalog and returns exploitation status, vendor/product info, due dates, ransomware association, and cryptographically signed metadata.","exampleAgentPrompt":"Before we deploy this update, check if CVE-2021-44228 is on the CISA Known Exploited Vulnerabilities list — I need to know if it's been exploited in ransomware attacks and what the required patching deadline is.","exampleUseCases":[{"title":"Pre-deployment vulnerability triage","prompt":"We're about to push a build that includes an older version of Log4j — can you check if CVE-2021-44228 is in the CISA KEV catalog and whether ransomware groups have been using it?"},{"title":"Federal patch compliance check","prompt":"I need to know if CVE-2023-44487 is on the CISA Known Exploited Vulnerabilities list and what the official remediation due date is — we have to comply with BOD 22-01."},{"title":"Security alert enrichment for SOC","prompt":"Our SIEM just fired an alert referencing CVE-2024-3400 — look it up in the CISA KEV catalog and tell me the vendor, product, when it was added, and what action is required."}],"resultDescription":"Returns a JSON object with: whether the CVE is in the KEV catalog (in_kev boolean), CVE ID, vulnerability name, vendor, product, date added to KEV, remediation due date, required action text, ransomware association flag, notes URLs, catalog version, and a full signed metadata block including sha256 hash, cryptographic signature, source URL, dataset label, license (CC0-1.0), snapshot ID, and staleness indicator.","failureModes":["CVE not found in KEV catalog — returns in_kev: false rather than an error","Invalid CVE format may return a 400 or empty result","Stale data flag (meta.stale: true) if the snapshot is outdated","Payment failure (402) if USDC balance is insufficient","Network timeout if the server is temporarily unavailable"],"whenToPreferThis":"Choose this endpoint when you need authoritative, cryptographically signed confirmation of whether a specific CVE has been flagged by CISA as actively exploited — especially for compliance workflows (BOD 22-01), pre-deployment security checks, or SOC alert enrichment. It is preferable to raw CISA feeds when you need a pay-per-call model with no account setup, signed responses for audit trails, and normalized structured data. Use over generic CVE databases (NVD, OSV) when exploitation status and ransomware association are the primary concern.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T12:43:37.253Z","isFirstParty":false,"canonicalSlug":"stack-facts-cisa-kev-cve-lookup-79fa3f68"}