CVE & Exploit Intelligence Monitor: NVD + CISA KEV + EPSS (MCP)

Vulnerability intelligence for humans and AI agents: every NVD CVE, enriched with "is it actively exploited?" (CISA KEV) and "how likely to be exploited?" (EPSS) — in one run, no key, no login, MCP-compatible.

Why this is hard (and why agents need it)

• Three official feeds that nobody joins for free: NVD publishes ~150 new CVEs per day (30,000+ CRITICAL in total), CISA maintains the KEV catalog of CVEs confirmed exploited in the wild, and FIRST.org scores exploitation probability (EPSS). Each has a different API, rate limits, and format. This actor resolves all three into one row per CVE.
• NVD's API v2 pagination, 120-day window limits, and public rate-limit pacing are handled for you — rejected CVEs are filtered out automatically.
• An LLM answering "is CVE-2024-21762 exploited?" from memory is guessing. Here you get CISA's live answer: exploited since 2024-03-01, due date, known ransomware use, plus EPSS percentile.

What you get per CVE

field	meaning
cveId, description	CVE identifier + official English description (NVD)
cvssScore, severity, cvssVector	CVSS v3.1 (fallback v3.0/v2): base score, severity, full vector
kevExploited	true when CISA lists the CVE as exploited in the wild
kevDateAdded, kevDueDate, kevRansomware	when CISA cataloged it, the federal patch deadline, ransomware campaign flag
kevVendor, kevProduct, kevName	vendor / product / short name from CISA
epssScore, epssPercentile	exploitation probability (0–1) and percentile rank (FIRST.org EPSS)
cwes, affectedCpEs, referencesCount	weakness IDs, affected product CPE strings (up to 10), reference count
publishedISO, lastModifiedISO, vulnStatus	NVD timeline + status

Mode search

{ "mode": "search", "query": "openssl", "minSeverity": "CRITICAL", "maxResults": 10 }

• Keyword/product search, exact CVE-2024-21762 lookup, optional severity floor.
• Every row includes KEV + EPSS joins. Charged per CVE row: $0.001.

Mode monitor — new-CVE & exploitation radar

{ "mode": "monitor", "watchlist": ["openssl", "fortinet", "microsoft windows"], "minSeverity": "HIGH" }

• Run 1 = free baseline (info row only): saves a time cursor plus the full KEV snapshot.
• Run 2+ = diff: CVEs published since the cursor matching your watchlist (changeKind: "new-cve", with matchedTerm) plus CVEs newly added to CISA KEV (changeKind: "kev-added") — even older CVEs attackers just started exploiting.
• Schedule daily/weekly; a no-news run costs $0.001 total. Add a webhook to Slack / Teams / n8n for instant alerts.

Three ready recipes

1. SOC / AI security agent — as an MCP tool, your agent answers "is this CVE exploited? how bad is it?" with CISA-confirmed exploitation status, patch deadline, EPSS percentile and CVSS vector, with source links.
2. Stack watch — watchlist = your deployed products (["windows server 2019", "apache http server", "openvpn"]), run daily, get only NEW CVEs and NEWLY EXPLOITED ones — the two things that actually demand action.
3. Vendor risk shortlist — severity CRITICAL + keyword search on a vendor/product → ranked enriched shortlist for risk assessments and RFP questionnaires.

Data honesty & limits

• kevExploited means CISA confirmed exploitation — absence means "not in KEV", not "never exploited".
• epssScore is a statistical probability (FIRST.org model), not a guarantee; v1 feeds without EPSS coverage return empty strings.
• All fields come from the official feeds at run time; rejected/reserved CVEs are skipped (empty vulnStatus only appears for minimal KEV-lookup fallbacks).
• Public NVD rate limits apply; the actor paces requests (default 1 s).

Sources (official, anonymous, no key)

• NVD — National Vulnerability Database API 2.0: https://nvd.nist.gov
• CISA — Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST.org — EPSS (Exploit Prediction Scoring System): https://www.first.org/epss

Price

event	price
Actor start	$0.001
CVE intel row extracted (search match, new watchlist CVE, or KEV addition)	$0.001 / row

Typical runs: enriched 10-row search ≈ $0.011 · daily stack watch with 2 new CVEs + 1 KEV addition ≈ $0.004.

MCP / AI-agent usage

Add the actor to your agent's tools, or call:

https://api.apify.com/v2/acts/YOUR_HANDLE~cve-exploit-intel-monitor/run-sync-get-dataset-items?token=YOUR_TOKEN

Input = the JSON examples above. Output = the dataset rows described in the table. Compatible with per-request agentic payments.

Questions / feedback: see the actor's Issues tab on Apify Store.