CVE Scraper: NVD Vulnerabilities, CVSS & KEV

CVE Scraper: NVD Vulnerabilities, CVSS & KEV searches the official NIST National Vulnerability Database (NVD 2.0 API) by product, vendor, CVE ID, CWE, CPE, severity or date range. Each row has up to 73 fields: CVSS v2, v3 and v4 scores and vectors, CWE weaknesses, advisory links, affected CPE products, CISA KEV status with the remediation deadline and required action, plus optional EPSS exploit probability and OSV open-source package versions. No login, no API key. Export CSV, Excel, JSON or XML. Error rows and empty searches are free. "Only new results" returns just CVEs new since your last run.

The NVD lists about 401,000 CVEs, about 1,700 in the CISA Known Exploited Vulnerabilities (KEV) catalog (live counts, 2026-10-04). Log4Shell (CVE-2021-44228) comes back as CVSS 10.0 CRITICAL, in KEV since 2021-12-10 with a 2021-12-24 deadline, 4 CWE classes and 30 reference links.

🛡 What does the CVE Scraper do?

• Searches NVD by keyword (product, vendor, technology) or exact CVE IDs such as CVE-2021-44228.
• Filters by CVSS v3 or v2 severity, CWE weakness, CPE product, NVD tag, source (CNA), exact phrase, and publication or last-modified date range.
• Returns only CISA KEV (actively exploited) vulnerabilities, or skips rejected CVEs.
• Attaches CWE weaknesses, reference links, affected CPE strings, EPSS exploit probability and OSV open-source packages as optional modules.

📋 What data can you extract from the NVD?

Field	Meaning
recordType, cveId, url, vulnStatus, cveTags, description	Row type, CVE identifier, NVD page, analysis status, tags such as disputed, English description
cvssV3Score, cvssV3Severity, cvssV3Vector and the eight v3 components	CVSS v3.1 or v3.0 base score, severity, vector, plus exploitabilityScore and impactScore
cvssV4Score, cvssV4Severity, cvssV4Vector and 14 more cvssV4... columns; cvssV2Score, cvssV2Vector	CVSS v4.0 and legacy v2 when NVD has them
knownExploited, kevDateAdded, kevActionDue, kevRequiredAction, kevVulnerabilityName	CISA KEV status, date added, remediation deadline, required action and name
ssvcExploitation, ssvcAutomatable, evaluatorComment, affectedVendors, affectedProducts, referenceCount	SSVC decision points, analyst notes, parsed vendors and products, link counts
published, lastModified, sourceIdentifier	Dates and the CNA that reported it
weaknesses, references, affectedCpes	CWE classes; up to 30 advisory, patch and exploit links; up to 50 CPE strings (modules)
epssScore, epssPercentile, epssDate	FIRST.org EPSS probability of exploitation in the next 30 days (module)
osvAliases, osvPackages	OSV.dev aliases and affected packages with ecosystem, purl and introduced, fixed and last affected versions (module)
searchTerm, scrapedAt	The keyword that found the row and the UTC scrape time

That is 73 fields with every module on. Fields NVD has no value for show Not Disclosed (N/A for KEV and CVSS v2); empty module columns are left out.

📊 Sample output of the CVE search

Real record (shortened) from a run with keywords: ["openssl"], severity: "HIGH":

{
  "recordType": "cve",
  "cveId": "CVE-2004-0079",
  "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0079",
  "vulnStatus": "Modified",
  "description": "The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake...",
  "cvssV3Score": 7.5,
  "cvssV3Severity": "HIGH",
  "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "cvssV2Score": 5,
  "knownExploited": "No",
  "published": "2004-11-23T05:00:00.000",
  "searchTerm": "openssl",
  "weaknesses": ["CWE-476"],
  "references": [
    { "url": "ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:05.openssl.asc", "tags": ["Broken Link"] }
  ],
  "scrapedAt": "2026-10-04T05:19:21.465Z"
}

💵 How much does it cost to scrape NVD CVEs?

Pay per event (live Free tier prices):

Event	Price	Charged when
CVE record	$0.015 per CVE ($15 per 1,000)	One per delivered CVE row
CWE weaknesses, references, affected products (CPEs), open-source packages (OSV)	$0.01 per CVE each	The CVE has that data and the module is on
EPSS exploit probability	$0.005 per CVE	The CVE has an EPSS score and the module is on

On paid plans the CVE record price drops from $0.015 to $0.01219 on Gold; module prices stay flat.

With the default modules (weaknesses and references on), 1,000 CVEs cost about $35 ($15 records + $10 weaknesses + $10 references). Add CPEs and it is about $45. With every module on, a CVE costs $0.015 + 3 x $0.01 + $0.005 + $0.01 = $0.06, so 1,000 CVEs cost $60. Adding only EPSS to the defaults is $40 per 1,000. The v2, v4, KEV and SSVC columns cost nothing extra. Error rows, empty searches and failed runs are not charged; the "Max total charge" limit stops the run cleanly. Free users get a 10-CVE preview per run.

🔔 Only new results (monitor mode)

Turn on Only new results (onlyNew) to get just the CVEs that this same search has not returned before. Use stateKey for separate monitors with identical filters and resetSeen to clear the list.

Delivered CVE IDs are stored in a key-value store named cve-seen in your own account, one record per search, and remembered only after the row was saved and charged. Skipped CVEs are filtered before maxItems and before any charge, so they are free. If nothing is new, the run succeeds and charges nothing.

Schedule, for example, {"keywords": ["fortinet"], "severity": "CRITICAL", "onlyNew": true, "maxItems": 100} daily. NVD lists results oldest first, so add a publishedAfter date to follow only recent CVEs.

🚀 How to scrape CVE data in 3 steps

1. Enter keywords (for example openssl), CVE IDs, or a severity, KEV-only or date filter, then set Max Items.
2. Pick optional modules.
3. Click Start and download the dataset as CSV, Excel, JSON or XML.

⚙️ Input

Field	Type	Default	Description
keywords	list of text	none	One NVD search per keyword
cveIds	list of text	empty	Exact CVE IDs, looked up first
maxItems	integer	10	Max CVE records (1,000,000 on paid plans)
severity, cvssV2Severity	select	any	LOW, MEDIUM, HIGH or CRITICAL (CVSS v3); LOW to HIGH (v2)
onlyKnownExploited	boolean	false	Only CISA KEV vulnerabilities
cweId	select	any	One CWE weakness, for example CWE-79; child weaknesses are included
cveTag, sourceIdentifier	select, text	any	NVD tag such as disputed; one source (CNA), for example security@apache.org
cpeName, cpeMatch	text	empty	Exact CPE 2.3 name; start of a CPE name for all versions
publishedAfter/Before, lastModifiedAfter/Before	YYYY-MM-DD	empty	Publication or last-modified range, 120 days maximum
excludeRejected, exactMatch	boolean	false	Skip Rejected CVEs; match each keyword as an exact phrase
includeWeaknesses, includeReferences, includeConfigurations, includeEpss, includeOsv	boolean	true, true, false, false, false	Optional data modules
onlyNew, stateKey, resetSeen	mixed	false	Monitor mode; monitor name; clear the seen list

Give at least one keyword, CVE ID or filter. publishedBefore needs publishedAfter (same for the last-modified pair).

{ "keywords": ["fortinet"], "severity": "CRITICAL", "onlyKnownExploited": true, "maxItems": 50 }

📦 Output

One row per CVE. Invalid CVE IDs add a free row with an error text. A search with no matches finishes as Succeeded and charges nothing.

📈 NVD CVE scraper vs alternatives

Read on 2026-10-09 from the public Store pages of ryanclinton/nvd-cve-vulnerability-search and glitchbound/cve-scraper:

Capability	This actor	ryanclinton	glitchbound
Coverage	NVD, up to 1,000,000 rows	NVD, up to 10,000 rows	NVD plus OSV
Output fields	73	18	28
CISA KEV deadline and action	Yes, on every row	Not shown	Not shown
EPSS exploit probability	Yes, module	Not shown	Not shown
OSV package versions	Yes, module	Not shown	Yes
Only-new mode	Yes, skipped rows free	Not shown	Not shown
Price per 1,000 results	$15, modules extra	from $3	from $1.50

Both rivals are cheaper per row; glitchbound is cheapest and built around package audits. This actor costs more, and modules add $10 per 1,000 each (EPSS $5). It fits better when you need the KEV remediation deadline, EPSS, a CWE or CPE filter or new-only monitoring. For only CVE ids and scores at the lowest price, pick a cheaper actor.

💼 Use cases

• Patch prioritization: CRITICAL CVEs with KEV flags, sorted by kevActionDue.
• Asset matching: join affectedCpes to your CMDB.

🔌 Run it via API, schedule and integrations

curl -X POST "https://api.apify.com/v2/acts/recordsdata~cve-vulnerabilities-scraper/runs?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keywords":["openssl"],"severity":"HIGH","maxItems":20}'

Use Apify schedules, webhooks and the Zapier, Make, n8n or Google Sheets integrations.

🤖 CVE Scraper MCP server for AI agents

AI agents can call this actor through the Apify MCP server at https://mcp.apify.com?tools=RecordsData/cve-vulnerabilities-scraper. Add this to your MCP client configuration (Claude Desktop, Cursor, VS Code or any remote client):

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com?tools=RecordsData/cve-vulnerabilities-scraper"
    }
  }
}

Example agent prompt:

Use the CVE Scraper to find CRITICAL vulnerabilities for fortinet that are in the CISA KEV catalog, limit to 50, and list them sorted by remediation deadline.

Tool description: choose this actor when an agent needs NVD vulnerability data, CVSS scores or CISA KEV exploitation status for a product, vendor or list of CVE IDs.

⚖️ Is it legal to scrape the NVD?

The data comes from the public NVD 2.0 API run by NIST, a US government resource. The actor requests only public vulnerability records. This is an independent tool, not affiliated with NIST, NVD or CISA.

❓ Frequently asked questions

How do I export NVD CVE data for a product to CSV?

Enter the product or vendor name as a keyword, set Max Items, and click Start. The actor queries the NIST National Vulnerability Database and writes one row per CVE with CVSS score, severity and KEV status. Then download the dataset from the Storage tab as CSV, Excel, JSON or XML.

How do I find only actively exploited vulnerabilities?

Switch on "Only CISA KEV". Every returned CVE is then in the CISA Known Exploited Vulnerabilities catalog, and each row carries kevDateAdded, the kevActionDue remediation deadline and the kevRequiredAction text. Combine it with a severity filter or a keyword to narrow the list.

Does the CVE Scraper include the full CVSS vector?

Yes. For each CVE it returns the CVSS v3.1 or v3.0 base score, the severity label, the full vector string such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and the exploitability and impact sub-scores, plus the legacy CVSS v2 score and the CVSS v4.0 columns when NVD has them.

Can I look up specific CVE IDs with the NVD CVE Scraper?

Yes. Paste IDs such as CVE-2021-44228 into the "Specific CVE IDs" field and the actor looks them up on the NVD before any keyword search. An invalid or unknown ID does not fail the run: it adds a free error row with an error text.

How do I get only new CVEs since my last run?

Switch on "Only new results" and run the same search on an Apify Schedule. The actor remembers the CVE IDs it already delivered in a key-value store called cve-seen in your own account and skips them next time, free. Use resetSeen to start the list over.

How do I add EPSS exploit probability to CVE data?

Switch on "EPSS exploit probability" (includeEpss). Each CVE then gets epssScore, epssPercentile and epssDate from FIRST.org: the estimated probability of exploitation in the next 30 days. A CVE too new to be scored is not charged for the module, which costs $0.005 per CVE with an EPSS score.

Which open-source packages does a CVE affect (OSV)?

Switch on "Open-source packages (OSV)" (includeOsv). The actor looks the CVE up on OSV.dev and reads related GHSA, PYSEC, GO and RUSTSEC records. Each row gets osvAliases and osvPackages with ecosystem, package, purl and the introduced, fixed and last affected versions. It costs $0.01 per CVE that has OSV data; others are not charged.

How do I filter CVEs by CWE weakness or CPE product?

Pick a weakness in "CWE weakness" (for example CWE-79) and the actor returns only CVEs under it, including child weaknesses. For products, use cpeName with a full CPE 2.3 name for one version, or cpeMatch with a partial name such as cpe:2.3:a:openssl:openssl for all versions of the product.

Why did my NVD CVE search return 0 results?

The keyword or filter matched nothing, so the run finishes as Succeeded with an empty dataset and no charge. Try a broader keyword or drop the severity filter. If the NVD rejects a parameter or is down, the run fails with a clear message.

What happens if I send an empty or invalid input to the CVE Scraper?

The run does not fail and nothing is charged. With no keyword, CVE ID or filter, or a bad date range, it ends as Succeeded with a single free error row (errorType: invalid-input, plus error and hint text). Real failures, such as an NVD outage with no rows delivered, still fail the run.

Why did my date filter fail in the NVD CVE Scraper?

The NVD allows a range of at most 120 days. Use the YYYY-MM-DD format in publishedAfter and publishedBefore, and split longer periods into several runs. The same limit applies to the last-modified pair, lastModifiedAfter and lastModifiedBefore, and both dates of a pair must be set together.

Do I pay for empty modules in the CVE Scraper?

No. The CWE weaknesses, references, affected products (CPE), EPSS and OSV modules are charged per CVE only when that CVE has data for the module. A CVE with no CWE data costs only the base record price plus the modules that returned data. Error rows and empty searches are never charged.

Does the NVD CVE Scraper need an NVD API key?

No. The actor uses the public no-key rate window of the NVD 2.0 API, so you register for nothing and paste no key into the input. The trade-off is that very large runs are paced more slowly, which keeps them reliable.

How fresh is the CVE data from the CVE Scraper?

The data is live from the NVD 2.0 API at run time, not a cached copy. The lastModified field shows when NVD last changed that CVE record, and scrapedAt the UTC time it was read. Schedule it daily or weekly with "Only new results".

🔗 Want more data tools? Other RecordsData scrapers

• SEC EDGAR Filings Scraper for breach disclosures in 8-K filings
• Hugging Face Scraper to audit AI models entering your stack
• Hacker News Search Scraper to follow security discussions

🆘 Support

Open an issue on the actor page or write to contact.punkrecordsdata@gmail.com.

Last updated: 2026-10-11