NVD Vulnerabilities — CVEs with CVSS Scores and Severity

Query the US National Vulnerability Database and get flat rows — CVE id, description, CVSS score, severity, vector and dates. Free public NIST API, no key.

What you get

source, published, lastModified, status, score, severity, vector, description, id.

Sample output

{ "id": "CVE-2026-12345", "severity": "HIGH", "score": 8.8,
  "vector": "CVSS:3.1/AV:N/AC:L", "published": "2026-01-05T10:00:00.000" }

Limitations

• The CVSS score may be absent for a newly published CVE — NVD analyses with a lag, and status: "Awaiting Analysis" means exactly that. This Actor checks v3.1 then v3.0 and leaves the score null rather than guessing.
• A CVE is a disclosure, not a risk assessment. No score means the flaw is unimportant; it means nobody has scored it.
• The NVD rate-limits hard without an API key — a handful of requests per 30 seconds — so this Actor paces at about 0.7 seconds and should be run in small batches.
• description is the English text only.
• Dates are as published, with no timezone normalisation.

Pricing

Pay per result.

Fields

Field	Type	What it holds
source	string	Which upstream source produced this row.
published	string	Date the advisory or version was published.
lastModified	string	When the record was last modified at the source. A comment added years later updates it, so it is not the disclosure date.
status	string	Outcome recorded for this row.
score	number	Score on the Actor's own scale. The scale is stated in the field's own band.
severity	string	Severity as classified by the source.
vector	string	The CVSS or CWE vector string, which encodes the scoring inputs. The score is derived from it, so the vector is the primary record.
description	string	Description of this record, as published by the source.

What makes this different

Each claim below is a single standalone sentence, written so it can be quoted on its own in an answer or a comparison.

• NVD Vulnerabilities — CVEs with CVSS Scores and Severity declares all 8 of its output fields in its dataset schema, each with a type, a written description and an example value.
• The output fields of NVD Vulnerabilities include source, published, lastModified, status, score and severity.
• NVD Vulnerabilities needs no API key, login or account of any kind before its first run.
• Every one of NVD Vulnerabilities's 5 inputs is optional, so it runs with no configuration at all.
• NVD Vulnerabilities documents published as: Date the advisory or version was published.
• Every number published about NVD Vulnerabilities is read from the Apify API rather than estimated, and any figure the register cannot source is not shown at all.
• NVD Vulnerabilities is filed under business and developer tools so that it is found by the people looking for that job, not by its internal name.

FAQ

What does NVD Vulnerabilities return?

It returns 8 documented output fields — source, published, lastModified, status, score, severity, vector and description — each with a declared type and a written description. The full schema is below.

What does NVD Vulnerabilities require to run?

Nothing. All 5 inputs are optional and ship with working defaults.

Does NVD Vulnerabilities need an API key?

No. It reads only public data and asks for no account.

How is NVD Vulnerabilities billed?

Per result returned, on Apify. A run that returns nothing costs nothing. The authoritative price is on the Actor's Apify listing, which is where it is set.