{"question":"How do I prioritise a CVE with its EPSS score and CISA KEV status?","answer":"Call GET https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/vuln/cve?id=CVE-2021-44228 for $0.005. One call returns the CVE's description, its CVSS score and severity with the publisher named, dates, CWE and key references, the FIRST EPSS probability of exploitation (score and percentile, with its date) and the CISA Known Exploited Vulnerabilities status (date added, due date, known ransomware use). To triage: a CVE that is listed in KEV is known to be exploited; EPSS ranks the rest by likelihood. A malformed or unknown CVE id is refused before any charge.","url":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/answers/cve-epss-kev-priority","data_as_of":"2026-10-25","facts":[{"label":"Example answer: CVE","value":"CVE-2021-44228; CVSS 10 CRITICAL (NVD)","text":"CVE-2021-44228; CVSS 10 CRITICAL (NVD)"},{"label":"Example answer: EPSS","value":"score 0.99999; percentile 1; dated 2026-10-25","text":"score 0.99999; percentile 1; dated 2026-10-25"},{"label":"Example answer: CISA KEV","value":"listed: yes; added 2021-12-10; due 2021-12-24; ransomware use: Known","text":"listed: yes; added 2021-12-10; due 2021-12-24; ransomware use: Known"}],"tables":[{"title":"Query parameters","columns":["Parameter","Needed","Meaning"],"rows":[{"name":"id","needed":"required","meaning":"CVE identifier, e.g. CVE-2021-44228"}]}],"sources":[{"name":"CVE.org (MITRE) CVE records","url":"https://www.cve.org/Legal/TermsOfUse","as_of":null,"age_days":null,"stale":false,"note":"CVE® record, Copyright © 1999-2026, The MITRE Corporation. Used under the CVE Program license (perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, sublicense and distribute CVE): https://www.cve.org/Legal/TermsOfUse"},{"name":"NVD (NIST)","url":"https://nvd.nist.gov/developers/start-here","as_of":null,"age_days":null,"stale":false,"note":"This product uses data from the NVD API but is not endorsed or certified by the NVD."},{"name":"FIRST EPSS","url":"https://www.first.org/epss/","as_of":null,"age_days":null,"stale":false,"note":"EPSS scores by FIRST / Empirical Security (https://www.first.org/epss/), free of charge."},{"name":"CISA Known Exploited Vulnerabilities Catalog","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","as_of":null,"age_days":null,"stale":false,"note":"CISA Known Exploited Vulnerabilities Catalog, CC0 1.0; not an endorsement by CISA or DHS."}],"not_loaded":[],"notes":["EPSS is an estimate published daily by FIRST of the probability that a vulnerability is exploited in the next 30 days; a high score is a reason to look first, not proof of exploitation. KEV membership is CISA's record that exploitation has been observed.","CVSS is the score of the publisher named in the answer (NVD when it answered, otherwise the CNA or ADP record of CVE.org). NVD is an optional source: when it does not answer, the score comes from the CVE record and the answer says whose it is.","The CISA catalog is kept as a compact copy that is refreshed at most once a day; the answer names the catalog version and date.","Not legal, financial or security advice; P0 is not affiliated with or endorsed by any of the publishers named here."],"request":{"method":"GET","url":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/vuln/cve?id=CVE-2021-44228","query":{"id":"CVE-2021-44228"},"price_usd":0.005,"curl":"curl -i \"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/vuln/cve?id=CVE-2021-44228\"","note":"The first call without payment answers HTTP 402 with the exact price and the payment requirements; pay and retry with an x402 or MPP client (see /integrations)."},"example_answer":{"path":"/vuln/cve","query":null,"body":{"id":"CVE-2021-44228","description":"Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints.","cve_state":"PUBLISHED","nvd_status":"Analyzed","cvss":{"version":"3.1","base_score":10,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provider":"NVD","primary":true},"cvss_scores":[{"version":"3.1","base_score":10,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provider":"NVD","primary":true}],"severity":"CRITICAL","published":"2021-12-10T10:15:09.143Z","last_modified":"2026-08-11T19:33:44.513Z","cwe":["CWE-20","CWE-400","CWE-502","CWE-917"],"references":[{"url":"https://logging.apache.org/log4j/2.x/security.html","tags":["Vendor Advisory"]}],"reference_count":103,"epss":{"score":0.99999,"percentile":1,"date":"2026-10-25","change_7d":0,"change_7d_from":"2026-10-18","series_30d":[{"date":"2026-10-24","score":0.99999,"percentile":1}]},"kev":{"listed":true,"date_added":"2021-12-10","due_date":"2021-12-24","known_ransomware_use":"Known","vendor":"Apache","product":"Log4j2","name":"Apache Log4j2 Remote Code Execution Vulnerability","required_action":"Apply updates per vendor instructions."},"kev_catalog":{"version":"2026.10.23","released":"2026-10-23T19:30:18.000Z","count":1756},"as_of":"2026-10-25T09:00:00.000Z","source":"CVE.org + NVD + FIRST EPSS + CISA KEV","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-44228","sources_used":["CVE.org","NVD","FIRST EPSS","CISA KEV"],"attribution":"CVE® record, Copyright © 1999-2026, The MITRE Corporation. Used under the CVE Program license (perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, sublicense and distribute CVE): https://www.cve.org/Legal/TermsOfUse This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS scores by FIRST / Empirical Security (https://www.first.org/epss/), free of charge. CISA Known Exploited Vulnerabilities Catalog, CC0 1.0; not an endorsement by CISA or DHS.","note":"Facts as returned by the sources, read at as_of; not remediation advice and not a risk score for your systems. cvss is the headline score: CVSS v3.x before v4.0 before v2, within a version NVD primary, then the CNA, then other NVD sources, then CISA ADP; every score the sources gave is in cvss_scores with its provider. NVD is optional: when it does not answer, scores come from the CVE.org record. epss is null when FIRST has not scored the CVE yet. KEV is the CISA catalog (kev.listed false means not in the catalog at kev_catalog.released)."},"label":"Recorded example answer of /vuln/cve: the example published in the route's own definition, not a live call. Its dates are the dates of that recording."},"full_answer":[{"path":"/vuln/cve","url":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/vuln/cve","price_usd":0.005,"what":"CVE triage (CVSS, EPSS, CISA KEV): the exact route this page describes"},{"path":"/check/infra","url":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/check/infra","price_usd":0.015,"what":"the same CVE plus an IP, a site, a package version and a software version in one call"}],"related":["https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/answers/check-infrastructure","https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/answers/pay-api-with-x402","https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/answers/check-counterparty"],"license":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/terms","operator":"dev Mike","version":"2026-10-25.2"}