CVE Alerts by Vendor or Product: New NVD Vulnerabilities

Get new and modified CVE vulnerability alerts by vendor, product name, or CPE from the National Vulnerability Database (NVD). Monitor critical vulnerabilities, zero-days, and patch updates across software components and libraries you rely on. Turn on monitoring mode and run it on a schedule to get only the CVEs that are new or modified since your last run, charged per vulnerability and free when nothing is new.

Security engineers, DevSecOps teams, and compliance officers use this actor to track vendor exposure, automate vulnerability triage in n8n or Slack, and maintain an audit log of newly disclosed CVEs.

How to use

1. In the Apify Console. Open the actor page and click Start — the keywords field is already pre-filled with a working example. Results land in the run's dataset as soon as each item is found.
2. Via the API. Call it directly with a POST request — no Console needed once you have an API token:

   curl "https://api.apify.com/v2/acts/accountable_eel~cve-vendor-product-alerts/run-sync-get-dataset-items?token=<YOUR_TOKEN>" \
     -X POST \
     -H "Content-Type: application/json" \
     -d '{"keywords":["apache","openssl"]}'
   

3. On a schedule. Save this actor as an Apify Task with the input you want, then add a Schedule (hourly, daily, weekly) so it runs on its own — no server of your own required.

Input

{
  "keywords": [
    "apache",
    "openssl"
  ]
}

One keyword, vendor name, product name, CPE 2.3 string (cpe:2.3:...) or CVE ID per line to search for vulnerabilities. Accepted formats: apache, openssl, CVE-2021-44228, cpe:2.3:a:apache:http_server::::::::.

Keywords, vendor names, or product names are matched against CVE descriptions and affected software configurations. You can also specify exact CVE IDs (e.g. CVE-2021-44228) or CPE criteria strings (e.g. cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*). Optional filters let you restrict by publication/modification window (sinceDays, up to 120 days) and minimum CVSS severity.

Output

One row per vulnerability, with details including:

query	found	status	cveId	title	severity	cvssScore	cvssVersion	cvssVector	description	cweIds	affectedCpes	publishedDate	lastModifiedDate	vulnStatus	cveUrl	references	isNew	changeType	firstSeenAt	scrapedAt
apache	true	OK	CVE-2012-5885	The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5....	MEDIUM	5	2.0	AV:N/AC:L/Au:N/C:P/I:N/A:N	The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka cli...	["CWE-264"]	["cpe:2.3:a:apache:tomcat:5.5.0:::::::","cpe:2.3:a:apache:tomcat:5.5.1:::::::","cpe:2.3:a:apache:tomcat:5.5.2:::::::","cpe:2.3:a:apache:tomcat:5.5.3:::::::","cpe:2.3:a:a...	2012-11-17T19:55:02.673	2026-10-09T20:17:05.170	Modified	https://nvd.nist.gov/vuln/detail/CVE-2012-5885	["http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html","http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html","http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.h...				2026-11-01T10:26:49.383Z

A miss comes back as a row with "found": false and is never charged. Missing fields are null, never 0 or "".

Limits

• NVD API rate limits: Keyless requests are paced sequentially to stay within NVD's public limits (about 5 requests per 30 seconds). Providing an optional free NVD API key via the apiKey setting raises the limit to 50 requests per 30 seconds.
• Date range: NVD limits lastModStartDate date filters to a maximum of 120 days per query. Queries with sinceDays exceeding 120 are automatically capped at 120 days.
• Results per keyword: Default is 20 vulnerabilities per keyword (configurable up to 100 via maxItems).

Pricing

• Vulnerability returned: $2 per 1,000 vulnerabilitys

Plus a $0.00005 start fee per run. Each event above is billed independently, only when it actually returns data — misses (found:false) are never charged.

Each event above is billed once per delivered vulnerability row. Misses (found: false) and runs with no new or modified vulnerabilities are never charged.

Example runs

Paste any of these into the Input tab and press Start. All three return rows with no key, no token, and no account of your own beyond an Apify login.

Recent Apache and OpenSSL vulnerabilities (last 30 days).

{
  "keywords": ["apache", "openssl"],
  "sinceDays": 30,
  "maxItems": 20
}

High and critical vulnerabilities for popular web servers.

{
  "keywords": ["nginx", "caddy"],
  "severity": "HIGH",
  "sinceDays": 60,
  "maxItems": 20
}

Continuous vulnerability monitoring (scheduled alerts).

{
  "keywords": ["log4j", "spring-framework", "kubernetes"],
  "onlyNewSinceLastRun": true,
  "deltaName": "prod-stack-alerts",
  "sinceDays": 30,
  "maxItems": 50
}

Use it from Clay, n8n, Make, or an AI agent

This actor runs synchronously over plain HTTP — call it directly from a script, a workflow tool, or an AI agent, no Apify Console needed once you have an API token.

curl "https://api.apify.com/v2/acts/accountable_eel~cve-vendor-product-alerts/run-sync-get-dataset-items?token=<YOUR_TOKEN>" \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"keywords":["apache","openssl"]}'

n8n. Add an HTTP Request node: Method POST, URL https://api.apify.com/v2/acts/accountable_eel~cve-vendor-product-alerts/run-sync-get-dataset-items?token=<YOUR_TOKEN>, Body Content Type JSON, JSON Body {"keywords":["apache","openssl"]} (swap in an expression from an earlier node for a real value).

Clay. Add an "HTTP API" column: Method POST, URL https://api.apify.com/v2/acts/accountable_eel~cve-vendor-product-alerts/run-sync-get-dataset-items?token=<YOUR_TOKEN>, Body {"keywords":["{{vulnerability}}"]}, mapping the row's vulnerability into the keywords array.

MCP. In Claude, Cursor, or any MCP client with the Apify MCP server, ask for "NVD CVE API: Vulnerability Alerts by Vendor" — the agent will find and run this actor.