CVE Details

Look up a CVE in NIST's vulnerability database, including severity, affected products and references where available.

Pay by wallet (x402) cve-details

Example

Input

{
  "cve_id": "CVE-2021-44228"
}

Answer

{
  "cvss": {
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
    "version": "3.1",
    "severity": "CRITICAL",
    "base_score": 10,
    "impact_score": 6,
    "exploitability_score": 3.9
  },
  "cve_id": "CVE-2021-44228",
  "source": "security@apache.org",
  "status": "Analyzed",
  "cwe_ids": [
    "CWE-20"
  ],
  "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "published": "2021-12-10T10:15:09.143",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    }
  ],
  "description": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features...",
  "last_modified": "2026-08-11T19:33:44.513",
  "cisa_kev_added": "2021-12-10",
  "cisa_action_due": "2021-12-24",
  "known_exploited": true,
  "affected_cpe_count": 373,
  "affected_cpes_sample": [
    "cpe:2.3:o:siemens:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:*"
  ]
}

Inputs

Field	Type	Required	What it is
`cve_id`	string	Yes	CVE identifier, e.g. CVE-2021-44228

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`cvss`	object	Usually (present for most inputs)
`cve_id`	string	Always (present in every successful answer)
`status`	string	Always (present in every successful answer)
`cwe_ids`	array	Usually (present for most inputs)
`nvd_url`	string	Always (present in every successful answer)
`published`	string	Always (present in every successful answer)
`references`	array	Always (present in every successful answer)
`description`	string	Always (present in every successful answer)
`known_exploited`	boolean	Always (present in every successful answer)
`last_modified`	—	Always (present in every successful answer)
`source`	—	Usually (present for most inputs)
`cisa_kev_added`	—	Sometimes (present only for some inputs)
`cisa_action_due`	—	Sometimes (present only for some inputs)
`affected_cpe_count`	—	Always (present in every successful answer)
`affected_cpes_sample`	—	Usually (present for most inputs)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "cve-details",
    "inputs": {
      "cve_id": "CVE-2021-44228"
    },
    "max_price_cents": 3
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "cve-details",
    "inputs": {
      "cve_id": "CVE-2021-44228"
    },
    "max_price_cents": 3
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "cve-details",
  inputs: {
    "cve_id": "CVE-2021-44228"
  },
  max_price_cents: 3,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="cve-details",
    inputs={
        "cve_id": "CVE-2021-44228",
    },
    max_price_cents=3,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i -X POST https://api.strale.io/x402/v2/cve-details \
  -H 'Content-Type: application/json' \
  -d '{
    "cve_id": "CVE-2021-44228"
  }'

Limitations

NVD allows 5 requests per 30 seconds without a key
Bursts are refused upstream with HTTP 429/503 and surfaced as a retryable error; a typical successful lookup takes about one second.
What to do instead: Space lookups out; for package-level exposure use cve-lookup, which queries OSV instead.
New CVEs can lack scores and affected-product details
NVD analysis lags disclosure by days to weeks; cvss, cwe_ids and affected_cpes_sample are then empty.
What to do instead: Check status; re-query later or read the vendor advisory in references.