NVD CVE Scraper

Every CVE in the National Vulnerability Database — CVSS scores, CWE weaknesses, CISA known-exploited status, affected products and references — as clean JSON.

The National Vulnerability Database (NVD), run by NIST, is the reference catalog of publicly disclosed security vulnerabilities (CVEs). This Actor scrapes CVE vulnerabilities from the NIST National Vulnerability Database (NVD) by keyword, CVE id, product, CWE, severity or date: CVSS v4.0/v3/v2 scores, CISA known-exploited status, affected versions and references. Any date range. No login, no proxy; optional free API key. Search by keyword or exact phrase, look up CVE ids, or paste any NVD CVE page or search link, then narrow the results by CVSS v3 severity, CWE weakness type, an affected product (CPE), CISA's Known Exploited Vulnerabilities catalog, and published or last-modified dates of any length. Each CVE comes back with its English description, status, headline score, full CVSS v4.0, v3 and v2 blocks with vector strings and base metrics, CISA's SSVC decision, the KEV due date and required action, the NVD's affected-product configurations flattened to one row per CPE with version ranges, the vendor's own affected versions, and every reference link with its tags. Built for vulnerability management, security operations, threat intelligence, software supply-chain and compliance teams, and anyone feeding CVE data into a dashboard, ticketing system or AI pipeline.

⚡ Quick start

{
  "startUrls": [
    {
      "url": "https://nvd.nist.gov/vuln/search?resultType=records&keyword=apache&cisaKev=true"
    }
  ],
  "cveIds": ["CVE-2021-44228"],
  "maxItems": 5
}

🧩 Input

Field	Type	Required	Default	Description
startUrls	array	no	—	NVD pages: a CVE page (https://nvd.nist.gov/vuln/detail/CVE-2021-44228) or a vulnerability search (https://nvd.nist.gov/vuln/search?resultType=records&keyword=log4j). Classic …/vuln/search/results?query=… links work too.
searchTerms	array	no	—	Words to find in CVE descriptions, one search per line, such as log4j. Every word must appear; quote a phrase for an exact match ("remote code execution"). A CVE id here is looked up directly.
cveIds	array	no	—	Specific CVEs to look up, one per line, such as CVE-2021-44228.
severities	array	no	—	Only return CVEs with one of these CVSS v3 severities: CRITICAL, HIGH, MEDIUM, LOW.
cweIds	array	no	—	Only return CVEs with one of these weakness types, such as CWE-79 (cross-site scripting) or CWE-89 (SQL injection).
cpeName	string	no	—	Only return CVEs that affect this product version, as a CPE 2.3 name such as cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*.
knownExploitedOnly	boolean	no	false	Only return CVEs in CISA's Known Exploited Vulnerabilities (KEV) catalog.
publishedFrom	string	no	—	Only return CVEs published on or after this date (YYYY-MM-DD).
publishedTo	string	no	—	Only return CVEs published on or before this date (YYYY-MM-DD).
modifiedFrom	string	no	—	Only return CVEs last modified on or after this date (YYYY-MM-DD).
modifiedTo	string	no	—	Only return CVEs last modified on or before this date (YYYY-MM-DD).
maxItems	integer	no	—	Maximum number of CVEs per URL or keyword search. The input form starts at 5; leave it empty for every matching CVE.
apiKey	string	no	—	Optional free NVD API key. It raises the NVD's rate limit tenfold, from 5 to 50 requests per 30 seconds.
proxyConfiguration	object	no	{ "useApifyProxy": false }	Proxy settings. The NVD needs no proxy.

Add NVD URLs, keywords, CVE ids, or any mix. The filters apply to every search, except where a search URL sets its own (its severity range, CWE list, CPE, KEV switch or dates). With no URL, keyword or CVE id, the filters alone make one search: for example every CRITICAL known-exploited CVE published this year. The easiest way to build a search is to run it on NVD vulnerability search with its filters and paste the address bar.

Getting a free NVD API key

The Actor works without a key. Without one, the NVD allows 5 requests every 30 seconds, and the Actor paces itself to that: a search returns up to 2,000 CVEs per request, but each CVE id is one request. A key raises the limit to 50 requests per 30 seconds. Request one at nvd.nist.gov/developers/request-an-api-key with your email address, confirm it from the email the NVD sends, and paste it into NVD API key. It is stored as a secret.

📤 Output

Each CVE is one dataset row. Search results come in the NVD's order (mostly oldest first); when a date range is split into windows, the newest window comes first. baseScore and baseSeverity are the headline score: CVSS v3 where the CVE has one, otherwise v4.0, otherwise v2. Each CVSS block is the NVD's own analysis where it has one (type: Primary), otherwise the score from the CVE's publisher (Secondary).

Fields

Field	Type	Description
cveId	string	CVE id, such as CVE-2021-44228.
url	string	The CVE's page on nvd.nist.gov.
sourceIdentifier	string	The CVE Numbering Authority that published it.
publishedAt	string	When the CVE was published (ISO 8601, UTC).
lastModifiedAt	string	When the NVD record last changed (ISO 8601, UTC).
vulnStatus	string	NVD analysis status: Analyzed, Modified, Awaiting Analysis, Undergoing Analysis, Deferred or Received.
cveTags	array	CVE tags such as disputed or unsupported-when-assigned.
description	string	English description of the vulnerability.
baseScore	number	Headline CVSS base score, 0–10.
baseSeverity	string	Headline severity: CRITICAL, HIGH, MEDIUM, LOW (or NONE).
cvssVersion	string	CVSS version of the headline score, such as 3.1 or 4.0.
cvssV3	object	CVSS v3.1 (or v3.0) score: version, source, type, vectorString, baseScore, baseSeverity, exploitabilityScore, impactScore and the base metrics (attack vector, complexity, privileges, user interaction, scope, impacts). null when not scored.
cvssV40	object	CVSS v4.0 score, same shape; metrics leaves out values that are not defined. null when not scored.
cvssV2	object	CVSS v2 score, same shape. null when not scored (the NVD stopped scoring v2 in 2022).
ssvc	object	CISA's SSVC decision: exploitation (none, poc, active), automatable and technicalImpact. null when not assessed.
weaknesses	array	CWE ids from the NVD and the publisher, such as CWE-917.
isKnownExploited	boolean	Whether the CVE is in CISA's Known Exploited Vulnerabilities catalog.
cisaKev	object	The KEV entry: exploitAdd (date added), actionDue (federal remediation deadline), requiredAction and vulnerabilityName. null when not listed.
configurations	array	Affected products from the NVD's analysis, one row per CPE: cpe, part (a application, o OS, h hardware), vendor, product, version, the version range (versionStartIncluding, versionStartExcluding, versionEndIncluding, versionEndExcluding) and vulnerable (false for a platform it runs on). Empty until the NVD analyses the CVE.
affectedProducts	array	Affected versions as the publisher reports them: vendor, product, packageName, version, lessThan, lessThanOrEqual and status. Often present before the NVD's own analysis.
references	array	Advisories, patches and write-ups: url, source and tags (such as Patch, Vendor Advisory or Exploit), one entry per link.

💡 Use cases

• Vulnerability management — pull every CVE for the products you run (by CPE or keyword) with scores, version ranges and fix links, and feed them into your patch queue.
• Exploited-first prioritisation — list the CVEs in CISA's KEV catalog, with federal due dates and SSVC exploitation status, to patch what attackers are actually using.
• Daily CVE feed — schedule a run with modifiedFrom set to yesterday to catch new and re-scored CVEs, and push them to Slack, Jira or a SIEM.
• Threat intelligence and research — trend CVEs by weakness type (CWE), vendor, severity or year across the whole NVD.
• Software supply chain and compliance — enrich SBOM findings and audit reports with authoritative NVD scores, CWE ids and references.
• AI and security copilots — give an LLM or RAG pipeline clean, structured CVE records instead of raw pages.

❓ FAQ

• Do I need an NVD API key? No. Without one the Actor stays within the NVD's public limit of 5 requests every 30 seconds. A free key (see above) makes large CVE id lists and big searches about ten times faster.
• Do I need a proxy? No. It runs without one by default.
• How far back does it go? The whole NVD, from 1988 to today. Date ranges of any length work: the NVD accepts at most 120 days per query, so longer ranges are split automatically and run newest first.
• How fast is it? A search returns up to 2,000 CVEs per request, so even large result sets finish in minutes. CVE ids are looked up one request each: about 80 per minute with a key, 9 per minute without.
• Why is a CVE's score null or its configurations empty? New CVEs wait for NVD analysis (Awaiting Analysis, Deferred). Until then the record carries only the publisher's own score, weaknesses and affected versions (affectedProducts).
• Which severity does the filter use? CVSS v3. A search URL whose severity range uses CVSS v4.0 or v2 filters on that version instead.
• Are rejected CVEs included? Searches leave out rejected CVE ids. Looking one up by id still returns it.
• Why did a run return fewer CVEs than expected? Keyword search matches words in the description only, and every word must appear. Try fewer words, or a CPE name for exact product matching. The log says when the NVD rejects a filter or a CVE id does not exist.

🔗 More scrapers by Anyx

• GitHub Trending Scraper
• npm Package Scraper
• PyPI Scraper
• Docker Hub Scraper

🤝 Anyx Solutions

We build custom scrapers and data-extraction pipelines.

• Email: tantosthor@gmail.com

🖼 Image credit

Image credit: nvd.nist.gov