{"sample":true,"route":"/vuln/cve","method":"GET","priceUsd":0.005,"request":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/vuln/cve?id=CVE-2021-44228","response":{"id":"CVE-2021-44228","description":"Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints.","cve_state":"PUBLISHED","nvd_status":"Analyzed","cvss":{"version":"3.1","base_score":10,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provider":"NVD","primary":true},"cvss_scores":[{"version":"3.1","base_score":10,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provider":"NVD","primary":true}],"severity":"CRITICAL","published":"2021-12-10T10:15:09.143Z","last_modified":"2026-08-11T19:33:44.513Z","cwe":["CWE-20","CWE-400","CWE-502","CWE-917"],"references":[{"url":"https://logging.apache.org/log4j/2.x/security.html","tags":["Vendor Advisory"]}],"reference_count":103,"epss":{"score":0.99999,"percentile":1,"date":"2026-10-25","change_7d":0,"change_7d_from":"2026-10-18","series_30d":[{"date":"2026-10-24","score":0.99999,"percentile":1}]},"kev":{"listed":true,"date_added":"2021-12-10","due_date":"2021-12-24","known_ransomware_use":"Known","vendor":"Apache","product":"Log4j2","name":"Apache Log4j2 Remote Code Execution Vulnerability","required_action":"Apply updates per vendor instructions."},"kev_catalog":{"version":"2026.10.23","released":"2026-10-23T19:30:18.000Z","count":1756},"as_of":"2026-10-25T09:00:00.000Z","source":"CVE.org + NVD + FIRST EPSS + CISA KEV","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-44228","sources_used":["CVE.org","NVD","FIRST EPSS","CISA KEV"],"attribution":"CVE® record, Copyright © 1999-2026, The MITRE Corporation. Used under the CVE Program license (perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, sublicense and distribute CVE): https://www.cve.org/Legal/TermsOfUse This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS scores by FIRST / Empirical Security (https://www.first.org/epss/), free of charge. CISA Known Exploited Vulnerabilities Catalog, CC0 1.0; not an endorsement by CISA or DHS.","note":"Facts as returned by the sources, read at as_of; not remediation advice and not a risk score for your systems. cvss is the headline score: CVSS v3.x before v4.0 before v2, within a version NVD primary, then the CNA, then other NVD sources, then CISA ADP; every score the sources gave is in cvss_scores with its provider. NVD is optional: when it does not answer, scores come from the CVE.org record. epss is null when FIRST has not scored the CVE yet. KEV is the CISA catalog (kev.listed false means not in the catalog at kev_catalog.released)."},"note":"Free sample: the answer shape and fields for the fixed example input in 'request'. Values are an example and may not be current data; a paid call returns live data for your own input.","buy":"Call https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/vuln/cve with an x402 or MPP client: the unpaid call answers HTTP 402 with the exact price; the paid call returns the data with a receipt. Other ways to pay: https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/pay"}