CVE lookup

Look up a CVE by id, or search CVEs by keyword or product: the NVD description, CVSS severity and vector (v4.0, v3.1, v2), CWE weaknesses, affected products and versions (CPE), and reference links, joined with the EPSS exploitation probability (next 30 days) and whether CISA lists it as a known exploited vulnerability (date added, due date, ransomware use). Send POST /api/cve-lookup with no required fields (5 optional) and pay $0.005 per call over x402 or MPP (there is no free tier). It returns a JSON object with query, results, returned, matched, complete and 3 more.

This product uses the NVD API but is not endorsed or certified by the NVD.

Category: Live public data · Tags: security cve vulnerability nvd epss · Also found as: nvd-lookup vulnerability-lookup cve-search

TRY IN PLAYGROUND →

Parameters

Example request

curl -i -X POST https://agent402.tools/api/cve-lookup \
  -H "Content-Type: application/json" \
  -d '{"cve":"CVE-2024-3094"}'

Without payment this returns HTTP 402 Payment Required with the exact price for cve-lookup; any x402 v2 or MPP client pays it and retries.

Example response

{
  "query": {
    "cve": "CVE-2024-3094"
  },
  "results": [
    {
      "id": "CVE-2024-3094",
      "status": "Modified",
      "published": "2024-03-29T17:15:21.150",
      "lastModified": "2025-11-04T22:16:02.230",
      "description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0...",
      "severity": "CRITICAL",
      "cvss": {
        "v40": null,
        "v31": {
          "score": 10,
          "severity": "CRITICAL",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "source": "nvd@nist.gov",
          "type": "Primary"
        },
        "v2": null
      },
      "cwes": [
        "CWE-506"
      ],
      "affected": {
        "products": [
          {
            "vendor": "tukaani",
            "product": "xz",
            "version": "5.6.0",
            "cpe": "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*"
          }
        ],
        "returned": 1,
        "total": 1,
        "complete": true
      },
      "references": {
        "links": [
          {
            "url": "https://access.redhat.com/security/cve/CVE-2024-3094",
            "tags": [
              "Vendor Advisory"
            ]
          }
        ],
        "returned": 1,
        "total": 1
      },
      "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3094",
      "epss": {
        "available": true,
        "probability": 0.85974,
        "percentile": 0.99723,
        "date": "2026-09-25"
      },
      "kev": {
        "available": true,
        "inCatalog": false,
        "catalogVersion": "2026.09.25"
      }
    }
  ],
  "returned": 1,
  "matched": 1,
  "complete": true,
  "truncated": false,
  "sources": {
    "nvd": {
      "name": "NVD (NIST National Vulnerability Database)",
      "notice": "This product uses the NVD API but is not endorsed or certified by the NVD."
    },
    "epss": {
      "name": "EPSS, Exploit Prediction Scoring System (FIRST.org; scores by Empirical Security)"
    },
    "kev": {
      "name": "CISA Known Exploited Vulnerabilities catalog (CC0)"
    }
  },
  "fetchedAt": "2026-09-25T16:40:00.000Z"
}

From an MCP client

catalog.call {
  "slug": "cve-lookup",
  "params": {
    "cve": "CVE-2024-3094"
  }
}

The hosted connector at https://agent402.tools/mcp needs a payment for cve-lookup; the stdio package pays it from a wallet or from AGENT402_CREDITS_KEY. Local install: npx -y agent402-mcp.

Errors and behavior

• Every field is optional. An input the tool rejects returns an HTTP 4xx whose body carries error, tool, expected, required and example.
• A paid call that ends in any status of 400 or above is not charged: settlement is cancelled when the tool fails.
• Wallet-only: this tool reaches the network or stored state, so it has no proof-of-work tier. A prepaid card-credits key (Authorization: Bearer a402_...) also pays it.
• A GET or HEAD to /api/cve-lookup returns the same 402 quote, so the price can be read without a body.
• An Idempotency-Key header makes a retried paid call replay the first 200 instead of charging again.

Paid call (JavaScript agent)

import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client();
client.setSpendControls?.(false); // keep your own spending ceiling in code
registerExactEvmScheme(client, { signer: privateKeyToAccount(KEY) });
const payFetch = wrapFetchWithPayment(fetch, client);

const res = await payFetch("https://agent402.tools/api/cve-lookup", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "cve": "CVE-2024-3094"
  }),
});

Related tools