# CVE Alerts by Vendor or Product: New NVD Vulnerabilities (`accountable_eel/cve-vendor-product-alerts`) Actor

Monitor National Vulnerability Database (NVD) CVE alerts by vendor, product name, or CPE. Get new and modified vulnerabilities with CVSS scores, severity, CWE IDs, and affected versions. Schedule alerts with no duplicate charges.

- **URL**: https://apify.com/accountable_eel/cve-vendor-product-alerts.md
- **Developed by:** [Adriana Voss](https://apify.com/accountable_eel) (community)
- **Categories:** Developer tools, Automation
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 vulnerability returneds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CVE Alerts by Vendor or Product: New NVD Vulnerabilities

**Get new and modified CVE vulnerability alerts by vendor, product name, or CPE from the National Vulnerability Database (NVD).**
Monitor critical vulnerabilities, zero-days, and patch updates across software components and libraries you rely on. Turn on monitoring mode and run it on a schedule to get only the CVEs that are new or modified since your last run, charged per vulnerability and free when nothing is new.

Security engineers, DevSecOps teams, and compliance officers use this actor to track vendor exposure, automate vulnerability triage in n8n or Slack, and maintain an audit log of newly disclosed CVEs.

### How to use

1. **In the Apify Console.** Open the actor page and click **Start** — the `keywords` field is already pre-filled with a working example. Results land in the run's dataset as soon as each item is found.
2. **Via the API.** Call it directly with a POST request — no Console needed once you have an API token:
   ```bash
   curl "https://api.apify.com/v2/acts/accountable_eel~cve-vendor-product-alerts/run-sync-get-dataset-items?token=<YOUR_TOKEN>" \
     -X POST \
     -H "Content-Type: application/json" \
     -d '{"keywords":["apache","openssl"]}'
   ```
3. **On a schedule.** Save this actor as an Apify **Task** with the input you want, then add a **Schedule** (hourly, daily, weekly) so it runs on its own — no server of your own required.

### Input

```json
{
  "keywords": [
    "apache",
    "openssl"
  ]
}
```

One keyword, vendor name, product name, CPE 2.3 string (cpe:2.3:...) or CVE ID per line to search for vulnerabilities. Accepted formats: apache, openssl, CVE-2021-44228, cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*.

Keywords, vendor names, or product names are matched against CVE descriptions and affected software configurations. You can also specify exact CVE IDs (e.g. `CVE-2021-44228`) or CPE criteria strings (e.g. `cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*`). Optional filters let you restrict by publication/modification window (`sinceDays`, up to 120 days) and minimum CVSS severity.

### Output

One row per vulnerability, with details including:

| query | found | status | cveId | title | severity | cvssScore | cvssVersion | cvssVector | description | cweIds | affectedCpes | publishedDate | lastModifiedDate | vulnStatus | cveUrl | references | isNew | changeType | firstSeenAt | scrapedAt |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| apache | true | OK | CVE-2012-5885 | The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.... | MEDIUM | 5 | 2.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka cli... | \["CWE-264"] | \["cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*","cpe:2.3:a:a... | 2012-11-17T19:55:02.673 | 2026-10-09T20:17:05.170 | Modified | https://nvd.nist.gov/vuln/detail/CVE-2012-5885 | \["http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html","http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html","http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.h... |  |  |  | 2026-11-01T10:26:49.383Z |

A miss comes back as a row with `"found": false` and is never charged. Missing fields are `null`, never `0` or `""`.

### Limits

- **NVD API rate limits**: Keyless requests are paced sequentially to stay within NVD's public limits (about 5 requests per 30 seconds). Providing an optional free NVD API key via the `apiKey` setting raises the limit to 50 requests per 30 seconds.
- **Date range**: NVD limits `lastModStartDate` date filters to a maximum of 120 days per query. Queries with `sinceDays` exceeding 120 are automatically capped at 120 days.
- **Results per keyword**: Default is 20 vulnerabilities per keyword (configurable up to 100 via `maxItems`).

### Pricing

- **Vulnerability returned**: $2 per 1,000 vulnerabilitys

Plus a $0.00005 start fee per run. Each event above is billed independently, only when it actually returns data — misses (`found:false`) are never charged.

Each event above is billed once per delivered vulnerability row. Misses (`found: false`) and runs with no new or modified vulnerabilities are never charged.

### Example runs

Paste any of these into the Input tab and press Start. All three return rows with no key, no token, and no account of your own beyond an Apify login.

**Recent Apache and OpenSSL vulnerabilities (last 30 days).**

```json
{
  "keywords": ["apache", "openssl"],
  "sinceDays": 30,
  "maxItems": 20
}
```

**High and critical vulnerabilities for popular web servers.**

```json
{
  "keywords": ["nginx", "caddy"],
  "severity": "HIGH",
  "sinceDays": 60,
  "maxItems": 20
}
```

**Continuous vulnerability monitoring (scheduled alerts).**

```json
{
  "keywords": ["log4j", "spring-framework", "kubernetes"],
  "onlyNewSinceLastRun": true,
  "deltaName": "prod-stack-alerts",
  "sinceDays": 30,
  "maxItems": 50
}
```

### Use it from Clay, n8n, Make, or an AI agent

This actor runs synchronously over plain HTTP — call it directly from a script, a workflow tool, or an AI agent, no Apify Console needed once you have an API token.

```bash
curl "https://api.apify.com/v2/acts/accountable_eel~cve-vendor-product-alerts/run-sync-get-dataset-items?token=<YOUR_TOKEN>" \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"keywords":["apache","openssl"]}'
```

**n8n.** Add an HTTP Request node: Method `POST`, URL `https://api.apify.com/v2/acts/accountable_eel~cve-vendor-product-alerts/run-sync-get-dataset-items?token=<YOUR_TOKEN>`, Body Content Type `JSON`, JSON Body `{"keywords":["apache","openssl"]}` (swap in an expression from an earlier node for a real value).

**Clay.** Add an "HTTP API" column: Method `POST`, URL `https://api.apify.com/v2/acts/accountable_eel~cve-vendor-product-alerts/run-sync-get-dataset-items?token=<YOUR_TOKEN>`, Body `{"keywords":["{{vulnerability}}"]}`, mapping the row's vulnerability into the `keywords` array.

**MCP.** In Claude, Cursor, or any MCP client with the Apify MCP server, ask for "NVD CVE API: Vulnerability Alerts by Vendor" — the agent will find and run this actor.

# Actor input Schema

## `keywords` (type: `array`):

One keyword, vendor name, product name, CPE 2.3 string (cpe:2.3:...) or CVE ID per line to search for vulnerabilities. Accepted formats: apache, openssl, CVE-2021-44228, cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*. You're only charged for the ones we actually find — a miss costs nothing.

## `sinceDays` (type: `integer`):

How far back to check for new or modified vulnerabilities (up to 120 days, per NVD API limits). Default is 30 days. NVD does not allow longer ranges, so there is no all-time search. Ignored for exact CVE ID lookups.

## `maxItems` (type: `integer`):

Up to 100. Caps how many vulnerabilities you get (and pay for) per keyword in one run.

## `severity` (type: `string`):

Return only vulnerabilities rated at this CVSS severity or higher (High returns High and Critical). CVEs without a CVSS rating are excluded when a minimum is set. Applied after fetching up to 100 CVEs per keyword, then capped at the max per keyword.

## `onlyNewSinceLastRun` (type: `boolean`):

On: only CVEs that are new or have been modified since your last run are returned and charged for — run this on a schedule as a vulnerability alert. Off: returns all matching CVEs every time.

## `deltaName` (type: `string`):

Optional. Name this search's monitoring memory so you can tell two schedules apart, or keep one memory across an input change. Leave empty to auto-derive from your keyword.

## `apiKey` (type: `string`):

Optional. A free NIST NVD API key (request from nvd.nist.gov). Without a key the actor waits about 6.5 seconds between NVD requests (5 per 30 seconds limit), so many keywords take longer; with a key it waits under 1 second.

## `testRun` (type: `boolean`):

Turn this on to test your input on a small sample before running the full list. Turn it off to process everything.

## `onlyFound` (type: `boolean`):

Only keep rows where something was actually found. Misses are always free, whether or not you show them here.

## `includeKeywords` (type: `array`):

Optional. Only keep results that mention at least one of these words (e.g. a job title, a city, a product name). Leave empty to keep everything.

## `excludeKeywords` (type: `array`):

Optional. Drop any result that mentions one of these words. Leave empty to skip nothing.

## `maxResults` (type: `integer`):

Optional. Stop the run once this many results have been found — useful for a quick, cheap sample. Leave blank for no limit.

## `columns` (type: `array`):

Choose which pieces of information to include in each result row. All are included by default.

## `expandRows` (type: `boolean`):

When on, each vulnerability found gets its own row instead of being grouped under its vulnerability. You're still only charged once per vulnerability, no matter how many rows it produces.

## `maxConcurrency` (type: `integer`):

Parallel requests. Keep conservative — this target has no browser fallback, so getting blocked costs more than slow-and-steady.

## Actor input object example

```json
{
  "keywords": [
    "apache",
    "openssl"
  ],
  "sinceDays": 30,
  "maxItems": 20,
  "severity": "all",
  "onlyNewSinceLastRun": false,
  "deltaName": "",
  "testRun": false,
  "onlyFound": false,
  "includeKeywords": [],
  "excludeKeywords": [],
  "columns": [
    "cveId",
    "title",
    "severity",
    "cvssScore",
    "cvssVersion",
    "cvssVector",
    "description",
    "cweIds",
    "affectedCpes",
    "publishedDate",
    "lastModifiedDate",
    "vulnStatus",
    "cveUrl",
    "references",
    "isNew",
    "changeType",
    "firstSeenAt"
  ],
  "expandRows": true,
  "maxConcurrency": 1
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "keywords": [
        "apache",
        "openssl"
    ],
    "includeKeywords": [],
    "excludeKeywords": []
};

// Run the Actor and wait for it to finish
const run = await client.actor("accountable_eel/cve-vendor-product-alerts").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "keywords": [
        "apache",
        "openssl",
    ],
    "includeKeywords": [],
    "excludeKeywords": [],
}

# Run the Actor and wait for it to finish
run = client.actor("accountable_eel/cve-vendor-product-alerts").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "keywords": [
    "apache",
    "openssl"
  ],
  "includeKeywords": [],
  "excludeKeywords": []
}' |
apify call accountable_eel/cve-vendor-product-alerts --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,accountable_eel/cve-vendor-product-alerts"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/sNFQJzU73n4aDa6cD/builds/x26vNDVeozNZKNuQE/openapi.json