Open Source Filings · Security CVE

import { wrapFetchWithPayment } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.PRIVATE_KEY);
const fetchWithPay = wrapFetchWithPayment(fetch, account);

const res = await fetchWithPay("https://api.osf-master-server.com/x402/security/cve/:cve_id", {
  method: "GET",
});
const data = await res.json();

curl -X GET \
  "https://api.osf-master-server.com/x402/security/cve/:cve_id?format=json" \
  -H "X-PAYMENT: <signed x402 payment>"

{
  "actively_exploited": true,
  "audit_receipt": {
    "check_id": "uuid",
    "result_sha256": "..."
  },
  "compliance_note": "This is a decision-support signal, not a guarantee. Confirm against the linked authoritative sources (cisa.gov, nvd.nist.gov, first.org) before acting.",
  "coverage_note": "Direct lookup against the US CISA Known Exploited Vulnerabilities (KEV) catalog, the FIRST EPSS model score, and the NVD CVE record. 'actively_exploited' reflects presence on the CISA KEV catalog ONLY. A CVE that is NOT on KEV is not necessarily safe or unexploitable - it simply is not on CISA's confirmed-exploited list. EPSS is a probability estimate, not proof.",
  "epss": {
    "epss_probability": 0.984,
    "exploitation_band": "Critical"
  },
  "exploitation_summary": "ON the CISA KEV catalog - confirmed exploited in the wild.",
  "nvd": {
    "cvss_severity": "CRITICAL"
  },
  "provenance_urls": {
    "cisa_kev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
  },
  "query": "CVE-2026-33017",
  "result": "FOUND",
  "service": "OSF Security - CVE Exploit Check"
}