# CVE Program Records — The Authoritative Vulnerability Entry (`alaudinburki/cve-records`) Actor

Look up a CVE in the CVE Program's own registry and get a flat row — state, assigner, dates, description and affected products. Free public API, no key. The upstream of every other CVE feed.

- **URL**: https://apify.com/alaudinburki/cve-records.md
- **Developed by:** [alaudin burki](https://apify.com/alaudinburki) (community)
- **Categories:** Business, Developer tools
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CVE Program Records — The Authoritative Vulnerability Entry

Look up a CVE and get a flat row — state, assigner, dates, description, vendor, product and CVSS.

Source: the CVE Program's own registry. Free, no key.

### What you get

`state`, `assigner`, `dateReserved`, `datePublished`, `dateUpdated`, `description`, `vendor`, `product`, `cvssScore`, `cvssSeverity`, `cvssVector`, `referenceUrl`, `url`, `id`.

### Sample output

```json
{ "id": "cveorg:CVE-2024-0001", "state": "PUBLISHED", "assigner": "PureStorage",
  "cvssScore": 7.5, "cvssSeverity": "HIGH", "vendor": "Pure Storage" }
```

### Limitations — read before buying

- **This is the UPSTREAM record**, and it can differ from NVD's. NVD re-scores and re-describes; actor 206 returns NVD's version.
- **`state` is REJECTED for a withdrawn CVE** — a rejected record has no useful description and must not be counted as a vulnerability.
- **Only the FIRST affected vendor and product are mapped.** One CVE often covers several, and they are in the response but not in the row.
- **`cvssScore` may be absent** — the assigning CNA is not obliged to score it, and NVD may score it later.
- **CVSS v4 records are not mapped**, only v3.1; the field path returns null rather than a wrong number.

### Pricing

Pay per result.

### Fields

| Field | Type | What it holds |
|---|---|---|
| `state` | string | State, province or region name. |
| `assigner` | string | The CNA that assigned the CVE id. It is the organisation that took the report, not the vendor. |
| `dateReserved` | string | Date the CVE id was reserved. Reservation can precede disclosure by a long time. |
| `datePublished` | string | Date the CVE record was published. This is the DISCLOSURE date, and the one to sort by. |
| `dateUpdated` | string | Date the CVE record was last revised. |
| `description` | string | Description of this record, as published by the source. |
| `vendor` | string | Vendor this record relates to. |
| `product` | string | Product name or identifier as the source records it. |
| `cvssScore` | number | CVSS base score, from 0 to 10. Higher is more severe. |
| `cvssSeverity` | string | Severity band derived from the CVSS score, e.g. HIGH. Derived, and only as good as the underlying score. |
| `cvssVector` | string | The full CVSS vector string for the score. |
| `referenceUrl` | string | A reference link the record cites. There are usually several, and they do not all carry equal weight. |
| `url` | string | The URL this row describes. |

### What makes this different

Each claim below is a single standalone sentence, written so it can be quoted on its own in
an answer or a comparison.

- CVE Program Records — The Authoritative Vulnerability Entry declares all 13 of its output fields in its dataset schema, each with a type, a written description and an example value.
- The output fields of CVE Program Records include state, assigner, dateReserved, datePublished, dateUpdated and description.
- CVE Program Records needs no API key, login or account of any kind before its first run.
- Every one of CVE Program Records's 3 inputs is optional, so it runs with no configuration at all.
- CVE Program Records documents `assigner` as: The CNA that assigned the CVE id. It is the organisation that took the report, not the vendor.
- Every number published about CVE Program Records is read from the Apify API rather than estimated, and any figure the register cannot source is not shown at all.
- CVE Program Records is filed under business and developer tools so that it is found by the people looking for that job, not by its internal name.

### FAQ

**What does CVE Program Records return?**

It returns 13 documented output fields — `state`, `assigner`, `dateReserved`, `datePublished`, `dateUpdated`, `description`, `vendor` and `product` — each with a declared type and a written description. The full schema is below.

**What does CVE Program Records require to run?**

Nothing. All 3 inputs are optional and ship with working defaults.

**Does CVE Program Records need an API key?**

No. It reads only public data and asks for no account.

**How is CVE Program Records billed?**

Per result returned, on Apify. A run that returns nothing costs nothing. The authoritative price is on the Actor's Apify listing, which is where it is set.

# Actor input Schema

## `cveId` (type: `string`):

A CVE identifier, e.g. CVE-2024-0001.

## `maxItems` (type: `integer`):

Stop after this many rows.

## `maxPages` (type: `integer`):

Stop after this many pages.

## Actor input object example

```json
{
  "maxItems": 500,
  "maxPages": 5
}
```

# Actor output Schema

## `results` (type: `string`):

One row per item, with the 13 fields listed under Views.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "maxItems": 500,
    "maxPages": 5
};

// Run the Actor and wait for it to finish
const run = await client.actor("alaudinburki/cve-records").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "maxItems": 500,
    "maxPages": 5,
}

# Run the Actor and wait for it to finish
run = client.actor("alaudinburki/cve-records").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "maxItems": 500,
  "maxPages": 5
}' |
apify call alaudinburki/cve-records --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,alaudinburki/cve-records"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/7ueuau35qeWlDxNwx/builds/mVoFxvbNOfHwhkCuq/openapi.json