# NVD Vulnerabilities — CVEs with CVSS Scores and Severity (`alaudinburki/nvd-cves`) Actor

Query the US National Vulnerability Database and get flat rows — CVE id, description, CVSS score, severity, vector and dates. Free public NIST API, no key.

- **URL**: https://apify.com/alaudinburki/nvd-cves.md
- **Developed by:** [alaudin burki](https://apify.com/alaudinburki) (community)
- **Categories:** Developer tools
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## NVD Vulnerabilities — CVEs with CVSS Scores and Severity

Query the US National Vulnerability Database and get flat rows — CVE id, description, CVSS score,
severity, vector and dates. Free public NIST API, no key.

### What you get

`source`, `published`, `lastModified`, `status`, `score`, `severity`, `vector`, `description`, `id`.

### Sample output

```json
{ "id": "CVE-2026-12345", "severity": "HIGH", "score": 8.8,
  "vector": "CVSS:3.1/AV:N/AC:L", "published": "2026-01-05T10:00:00.000" }
```

### Limitations

- **The CVSS score may be absent** for a newly published CVE — NVD analyses with a lag, and
  `status: "Awaiting Analysis"` means exactly that. This Actor checks v3.1 then v3.0 and leaves the
  score null rather than guessing.
- **A CVE is a disclosure, not a risk assessment.** No score means the flaw is unimportant; it means
  nobody has scored it.
- **The NVD rate-limits hard without an API key** — a handful of requests per 30 seconds — so this
  Actor paces at about 0.7 seconds and should be run in small batches.
- `description` is the English text only.
- Dates are as published, with no timezone normalisation.

### Pricing

Pay per result.

### Fields

| Field | Type | What it holds |
|---|---|---|
| `source` | string | Which upstream source produced this row. |
| `published` | string | Date the advisory or version was published. |
| `lastModified` | string | When the record was last modified at the source. A comment added years later updates it, so it is not the disclosure date. |
| `status` | string | Outcome recorded for this row. |
| `score` | number | Score on the Actor's own scale. The scale is stated in the field's own band. |
| `severity` | string | Severity as classified by the source. |
| `vector` | string | The CVSS or CWE vector string, which encodes the scoring inputs. The score is derived from it, so the vector is the primary record. |
| `description` | string | Description of this record, as published by the source. |

### What makes this different

Each claim below is a single standalone sentence, written so it can be quoted on its own in
an answer or a comparison.

- NVD Vulnerabilities — CVEs with CVSS Scores and Severity declares all 8 of its output fields in its dataset schema, each with a type, a written description and an example value.
- The output fields of NVD Vulnerabilities include source, published, lastModified, status, score and severity.
- NVD Vulnerabilities needs no API key, login or account of any kind before its first run.
- Every one of NVD Vulnerabilities's 5 inputs is optional, so it runs with no configuration at all.
- NVD Vulnerabilities documents `published` as: Date the advisory or version was published.
- Every number published about NVD Vulnerabilities is read from the Apify API rather than estimated, and any figure the register cannot source is not shown at all.
- NVD Vulnerabilities is filed under business and developer tools so that it is found by the people looking for that job, not by its internal name.

### FAQ

**What does NVD Vulnerabilities return?**

It returns 8 documented output fields — `source`, `published`, `lastModified`, `status`, `score`, `severity`, `vector` and `description` — each with a declared type and a written description. The full schema is below.

**What does NVD Vulnerabilities require to run?**

Nothing. All 5 inputs are optional and ship with working defaults.

**Does NVD Vulnerabilities need an API key?**

No. It reads only public data and asks for no account.

**How is NVD Vulnerabilities billed?**

Per result returned, on Apify. A run that returns nothing costs nothing. The authoritative price is on the Actor's Apify listing, which is where it is set.

# Actor input Schema

## `keyword` (type: `string`):

Optional word to match in the CVE description, e.g. apache, openssl, sql injection.

## `severity` (type: `string`):

LOW, MEDIUM, HIGH or CRITICAL.

## `pubStartDate` (type: `string`):

ISO date, e.g. 2026-01-01T00:00:00.000.

## `maxItems` (type: `integer`):

Stop after this many rows.

## `maxPages` (type: `integer`):

Stop after this many pages.

## Actor input object example

```json
{
  "maxItems": 500,
  "maxPages": 5
}
```

# Actor output Schema

## `results` (type: `string`):

One row per item, with the 8 fields listed under Views.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "maxItems": 500,
    "maxPages": 5
};

// Run the Actor and wait for it to finish
const run = await client.actor("alaudinburki/nvd-cves").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "maxItems": 500,
    "maxPages": 5,
}

# Run the Actor and wait for it to finish
run = client.actor("alaudinburki/nvd-cves").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "maxItems": 500,
  "maxPages": 5
}' |
apify call alaudinburki/nvd-cves --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,alaudinburki/nvd-cves"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/HQRpQEcuwLA4sFD8h/builds/XhLb7IjfKmBc9DzHP/openapi.json