NVD CVE Vulnerability Database Scraper

Exports CVE (Common Vulnerabilities and Exposures) records from NIST's official NVD JSON API, including CVSS base scores, severity ratings, CWE weakness classifications, and affected vendor/product data. Built for security teams, vulnerability management tools, and developers who need structured CVE data for dependency scanning, threat intelligence feeds, or compliance reporting without manually parsing the NVD web UI.

Why this scraper

• Reads NVD's official JSON API endpoints directly rather than scraping rendered HTML pages, so the data matches NIST's source records without layout-parsing errors.
• Returns 17 flat, typed fields per CVE — CVSS version, base score, severity, vector string, exploitability/impact sub-scores, CWE ID, vendor, product, and reference data — in one record instead of requiring separate lookups.
• Charges a flat $0.01 per run regardless of how many CVE records are returned, so pulling 20 or 500 records costs the same.

Output fields

Field	Type	Description
cveId	string	CVE identifier, e.g. CVE-1999-0095
sourceIdentifier	string	Organization that submitted the CVE
published	string	Publication date/time (ISO 8601)
lastModified	string	Last modification date/time (ISO 8601)
vulnStatus	string	NVD workflow status, e.g. Modified, Analyzed
description	string	English-language description of the vulnerability
cvssVersion	string	CVSS metric version used, e.g. 3.1, 2.0
baseScore	number	CVSS base score
baseSeverity	string	CVSS severity rating, e.g. HIGH, CRITICAL
vectorString	string	Full CVSS vector string
exploitabilityScore	number	CVSS exploitability sub-score
impactScore	number	CVSS impact sub-score
cweId	string	Primary CWE weakness identifier or description
vendor	string	Affected vendor name if listed
product	string	Affected product name if listed
referenceUrl	string	First reference URL for the CVE
referenceCount	integer	Total number of reference URLs listed for the CVE

Input

{
  "startUrls": [
    { "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=20" }
  ],
  "maxItems": 1000
}

You can point startUrls at any NVD cves/2.0 query, including filters like keywordSearch=apache or cvssV3Severity=CRITICAL.

Output

{
  "cveId": "CVE-1999-0095",
  "sourceIdentifier": "cve@mitre.org",
  "published": "1988-10-01T04:00:00.000",
  "lastModified": "2026-06-16T21:47:34.460",
  "vulnStatus": "Modified",
  "description": "The debug command in Sendmail is enabled, allowing attackers to execute commands as root.",
  "cvssVersion": "2.0",
  "baseScore": 10,
  "baseSeverity": "HIGH",
  "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "exploitabilityScore": 10,
  "impactScore": 10,
  "cweId": "NVD-CWE-Other",
  "vendor": "n/a",
  "product": "n/a",
  "referenceUrl": "http://seclists.org/fulldisclosure/2019/Jun/16",
  "referenceCount": 10
}

Pricing

$0.01 per actor run, charged once regardless of how many CVE records maxItems returns. A typical run pulling 20-500 CVE records costs $0.01 total.

Use cases

• Feeding a vulnerability management dashboard with CVSS scores and severity ratings for tracked vendor/product combinations.
• Building a CWE-tagged dataset to prioritize which weakness classes to fix first in a codebase.
• Monitoring newly published CRITICAL and HIGH severity CVEs for a specific keyword (e.g., a vendor or product name) as part of a security bulletin process.