# NVD CVE Scraper (`anyxsolutions/nvd-cve-scraper`) Actor Scrape CVE vulnerabilities from the NIST National Vulnerability Database (NVD) by keyword, CVE id, product, CWE, severity or date: CVSS v4.0/v3/v2 scores, CISA known-exploited status, affected versions and references. Any date range. No login, no proxy; optional free API key. - **URL**: https://apify.com/anyxsolutions/nvd-cve-scraper.md - **Developed by:** [Anyx Solutions](https://apify.com/anyxsolutions) (community) - **Categories:** Developer tools, AI - **Security:** Limited permissions - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $2.50 / 1,000 results This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event ## What's an Apify Actor? An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md. ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run. For examples already wired to this Actor's own input schema, see the [API](#api) section below. Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`). # README ![banner](https://anyx.solutions/banners/nvd-cve-scraper.png) ## NVD CVE Scraper **Every CVE in the National Vulnerability Database — CVSS scores, CWE weaknesses, CISA known-exploited status, affected products and references — as clean JSON.** The National Vulnerability Database (NVD), run by NIST, is the reference catalog of publicly disclosed security vulnerabilities (CVEs). This Actor scrapes CVE vulnerabilities from the NIST National Vulnerability Database (NVD) by keyword, CVE id, product, CWE, severity or date: CVSS v4.0/v3/v2 scores, CISA known-exploited status, affected versions and references. Any date range. No login, no proxy; optional free API key. Search by keyword or exact phrase, look up CVE ids, or paste any NVD CVE page or search link, then narrow the results by CVSS v3 severity, CWE weakness type, an affected product (CPE), CISA's Known Exploited Vulnerabilities catalog, and published or last-modified dates of any length. Each CVE comes back with its English description, status, headline score, full CVSS v4.0, v3 and v2 blocks with vector strings and base metrics, CISA's SSVC decision, the KEV due date and required action, the NVD's affected-product configurations flattened to one row per CPE with version ranges, the vendor's own affected versions, and every reference link with its tags. Built for vulnerability management, security operations, threat intelligence, software supply-chain and compliance teams, and anyone feeding CVE data into a dashboard, ticketing system or AI pipeline. ### ⚡ Quick start ```json { "startUrls": [ { "url": "https://nvd.nist.gov/vuln/search?resultType=records&keyword=apache&cisaKev=true" } ], "cveIds": ["CVE-2021-44228"], "maxItems": 5 } ``` ### 🧩 Input | Field | Type | Required | Default | Description | | -------------------- | ------- | -------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `startUrls` | array | no | — | NVD pages: a CVE page (`https://nvd.nist.gov/vuln/detail/CVE-2021-44228`) or a vulnerability search (`https://nvd.nist.gov/vuln/search?resultType=records&keyword=log4j`). Classic `…/vuln/search/results?query=…` links work too. | | `searchTerms` | array | no | — | Words to find in CVE descriptions, one search per line, such as `log4j`. Every word must appear; quote a phrase for an exact match (`"remote code execution"`). A CVE id here is looked up directly. | | `cveIds` | array | no | — | Specific CVEs to look up, one per line, such as `CVE-2021-44228`. | | `severities` | array | no | — | Only return CVEs with one of these CVSS v3 severities: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`. | | `cweIds` | array | no | — | Only return CVEs with one of these weakness types, such as `CWE-79` (cross-site scripting) or `CWE-89` (SQL injection). | | `cpeName` | string | no | — | Only return CVEs that affect this product version, as a CPE 2.3 name such as `cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*`. | | `knownExploitedOnly` | boolean | no | `false` | Only return CVEs in CISA's Known Exploited Vulnerabilities (KEV) catalog. | | `publishedFrom` | string | no | — | Only return CVEs published on or after this date (`YYYY-MM-DD`). | | `publishedTo` | string | no | — | Only return CVEs published on or before this date (`YYYY-MM-DD`). | | `modifiedFrom` | string | no | — | Only return CVEs last modified on or after this date (`YYYY-MM-DD`). | | `modifiedTo` | string | no | — | Only return CVEs last modified on or before this date (`YYYY-MM-DD`). | | `maxItems` | integer | no | — | Maximum number of CVEs per URL or keyword search. The input form starts at 5; leave it empty for every matching CVE. | | `apiKey` | string | no | — | Optional free NVD API key. It raises the NVD's rate limit tenfold, from 5 to 50 requests per 30 seconds. | | `proxyConfiguration` | object | no | `{ "useApifyProxy": false }` | Proxy settings. The NVD needs no proxy. | Add NVD URLs, keywords, CVE ids, or any mix. The filters apply to every search, except where a search URL sets its own (its severity range, CWE list, CPE, KEV switch or dates). With no URL, keyword or CVE id, the filters alone make one search: for example every CRITICAL known-exploited CVE published this year. The easiest way to build a search is to run it on [NVD vulnerability search](https://nvd.nist.gov/vuln/search) with its filters and paste the address bar. #### Getting a free NVD API key The Actor works without a key. Without one, the NVD allows 5 requests every 30 seconds, and the Actor paces itself to that: a search returns up to 2,000 CVEs per request, but each CVE id is one request. A key raises the limit to 50 requests per 30 seconds. Request one at [nvd.nist.gov/developers/request-an-api-key](https://nvd.nist.gov/developers/request-an-api-key) with your email address, confirm it from the email the NVD sends, and paste it into `NVD API key`. It is stored as a secret. ### 📤 Output Each CVE is one dataset row. Search results come in the NVD's order (mostly oldest first); when a date range is split into windows, the newest window comes first. `baseScore` and `baseSeverity` are the headline score: CVSS v3 where the CVE has one, otherwise v4.0, otherwise v2. Each CVSS block is the NVD's own analysis where it has one (`type: Primary`), otherwise the score from the CVE's publisher (`Secondary`). #### Fields | Field | Type | Description | | ------------------ | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `cveId` | string | CVE id, such as `CVE-2021-44228`. | | `url` | string | The CVE's page on nvd.nist.gov. | | `sourceIdentifier` | string | The CVE Numbering Authority that published it. | | `publishedAt` | string | When the CVE was published (ISO 8601, UTC). | | `lastModifiedAt` | string | When the NVD record last changed (ISO 8601, UTC). | | `vulnStatus` | string | NVD analysis status: `Analyzed`, `Modified`, `Awaiting Analysis`, `Undergoing Analysis`, `Deferred` or `Received`. | | `cveTags` | array | CVE tags such as `disputed` or `unsupported-when-assigned`. | | `description` | string | English description of the vulnerability. | | `baseScore` | number | Headline CVSS base score, 0–10. | | `baseSeverity` | string | Headline severity: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW` (or `NONE`). | | `cvssVersion` | string | CVSS version of the headline score, such as `3.1` or `4.0`. | | `cvssV3` | object | CVSS v3.1 (or v3.0) score: `version`, `source`, `type`, `vectorString`, `baseScore`, `baseSeverity`, `exploitabilityScore`, `impactScore` and the base `metrics` (attack vector, complexity, privileges, user interaction, scope, impacts). `null` when not scored. | | `cvssV40` | object | CVSS v4.0 score, same shape; `metrics` leaves out values that are not defined. `null` when not scored. | | `cvssV2` | object | CVSS v2 score, same shape. `null` when not scored (the NVD stopped scoring v2 in 2022). | | `ssvc` | object | CISA's SSVC decision: `exploitation` (`none`, `poc`, `active`), `automatable` and `technicalImpact`. `null` when not assessed. | | `weaknesses` | array | CWE ids from the NVD and the publisher, such as `CWE-917`. | | `isKnownExploited` | boolean | Whether the CVE is in CISA's Known Exploited Vulnerabilities catalog. | | `cisaKev` | object | The KEV entry: `exploitAdd` (date added), `actionDue` (federal remediation deadline), `requiredAction` and `vulnerabilityName`. `null` when not listed. | | `configurations` | array | Affected products from the NVD's analysis, one row per CPE: `cpe`, `part` (`a` application, `o` OS, `h` hardware), `vendor`, `product`, `version`, the version range (`versionStartIncluding`, `versionStartExcluding`, `versionEndIncluding`, `versionEndExcluding`) and `vulnerable` (`false` for a platform it runs on). Empty until the NVD analyses the CVE. | | `affectedProducts` | array | Affected versions as the publisher reports them: `vendor`, `product`, `packageName`, `version`, `lessThan`, `lessThanOrEqual` and `status`. Often present before the NVD's own analysis. | | `references` | array | Advisories, patches and write-ups: `url`, `source` and `tags` (such as `Patch`, `Vendor Advisory` or `Exploit`), one entry per link. |
Example output The lists are trimmed to their first entries; this CVE has 395 configuration rows and 52 references. ```json { "cveId": "CVE-2021-44228", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228", "sourceIdentifier": "security@apache.org", "publishedAt": "2021-12-10T10:15:09.143Z", "lastModifiedAt": "2026-08-11T19:33:44.513Z", "vulnStatus": "Analyzed", "cveTags": [], "description": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.", "baseScore": 10, "baseSeverity": "CRITICAL", "cvssVersion": "3.1", "cvssV3": { "version": "3.1", "source": "nvd@nist.gov", "type": "Primary", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "exploitabilityScore": 3.9, "impactScore": 6, "metrics": { "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" } }, "cvssV40": null, "cvssV2": { "version": "2.0", "source": "nvd@nist.gov", "type": "Primary", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "baseScore": 9.3, "baseSeverity": "HIGH", "exploitabilityScore": 8.6, "impactScore": 10, "metrics": { "accessVector": "NETWORK", "accessComplexity": "MEDIUM", "authentication": "NONE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE" } }, "ssvc": { "exploitation": "active", "automatable": "yes", "technicalImpact": "total" }, "weaknesses": ["CWE-20", "CWE-400", "CWE-502", "CWE-917"], "isKnownExploited": true, "cisaKev": { "exploitAdd": "2021-12-10", "actionDue": "2021-12-24", "requiredAction": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.", "vulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability" }, "configurations": [ { "cpe": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*", "part": "a", "vendor": "apache", "product": "log4j", "version": null, "versionStartIncluding": "2.0.1", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "2.3.1", "vulnerable": true }, { "cpe": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*", "part": "a", "vendor": "apache", "product": "log4j", "version": null, "versionStartIncluding": "2.4.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "2.12.2", "vulnerable": true } ], "affectedProducts": [ { "vendor": "Apache Software Foundation", "product": "Apache Log4j2", "packageName": null, "version": "2.0-beta9", "lessThan": "log4j-core*", "lessThanOrEqual": null, "status": "affected" } ], "references": [ { "url": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html", "source": "security@apache.org", "tags": ["Third Party Advisory", "VDB Entry"] }, { "url": "http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html", "source": "security@apache.org", "tags": ["Third Party Advisory", "VDB Entry"] } ] } ```
### 💡 Use cases - **Vulnerability management** — pull every CVE for the products you run (by CPE or keyword) with scores, version ranges and fix links, and feed them into your patch queue. - **Exploited-first prioritisation** — list the CVEs in CISA's KEV catalog, with federal due dates and SSVC exploitation status, to patch what attackers are actually using. - **Daily CVE feed** — schedule a run with `modifiedFrom` set to yesterday to catch new and re-scored CVEs, and push them to Slack, Jira or a SIEM. - **Threat intelligence and research** — trend CVEs by weakness type (CWE), vendor, severity or year across the whole NVD. - **Software supply chain and compliance** — enrich SBOM findings and audit reports with authoritative NVD scores, CWE ids and references. - **AI and security copilots** — give an LLM or RAG pipeline clean, structured CVE records instead of raw pages. ### ❓ FAQ - **Do I need an NVD API key?** No. Without one the Actor stays within the NVD's public limit of 5 requests every 30 seconds. A free key (see above) makes large CVE id lists and big searches about ten times faster. - **Do I need a proxy?** No. It runs without one by default. - **How far back does it go?** The whole NVD, from 1988 to today. Date ranges of any length work: the NVD accepts at most 120 days per query, so longer ranges are split automatically and run newest first. - **How fast is it?** A search returns up to 2,000 CVEs per request, so even large result sets finish in minutes. CVE ids are looked up one request each: about 80 per minute with a key, 9 per minute without. - **Why is a CVE's score `null` or its configurations empty?** New CVEs wait for NVD analysis (`Awaiting Analysis`, `Deferred`). Until then the record carries only the publisher's own score, weaknesses and affected versions (`affectedProducts`). - **Which severity does the filter use?** CVSS v3. A search URL whose severity range uses CVSS v4.0 or v2 filters on that version instead. - **Are rejected CVEs included?** Searches leave out rejected CVE ids. Looking one up by id still returns it. - **Why did a run return fewer CVEs than expected?** Keyword search matches words in the description only, and every word must appear. Try fewer words, or a CPE name for exact product matching. The log says when the NVD rejects a filter or a CVE id does not exist. ### 🔗 More scrapers by Anyx - [GitHub Trending Scraper](https://apify.com/anyxsolutions/github-trending-scraper) - [npm Package Scraper](https://apify.com/anyxsolutions/npm-scraper) - [PyPI Scraper](https://apify.com/anyxsolutions/pypi-scraper) - [Docker Hub Scraper](https://apify.com/anyxsolutions/docker-hub-scraper) ### 🤝 Anyx Solutions We build custom scrapers and data-extraction pipelines. - Email: tantosthor@gmail.com ### 🖼 Image credit Image credit: [nvd.nist.gov](https://nvd.nist.gov/) # Actor input Schema ## `startUrls` (type: `array`): Public NVD pages: a CVE page (https://nvd.nist.gov/vuln/detail/CVE-2021-44228) or a vulnerability search (https://nvd.nist.gov/vuln/search?resultType=records\&keyword=log4j). Classic search links (https://nvd.nist.gov/vuln/search/results?query=log4j\&search_type=all) work too. ## `searchTerms` (type: `array`): Words to find in CVE descriptions, one search per line, for example log4j or wordpress plugin (every word must appear). Quote a phrase for an exact match, for example "remote code execution". ## `cveIds` (type: `array`): Specific CVEs to look up, one per line, for example CVE-2021-44228 or CVE-2024-3094. ## `severities` (type: `array`): Only return CVEs with one of these CVSS v3 severities. Leave empty for every severity. ## `cweIds` (type: `array`): Only return CVEs with one of these weakness types, one per line, for example CWE-79 (cross-site scripting), CWE-89 (SQL injection) or CWE-787 (out-of-bounds write). ## `cpeName` (type: `string`): Only return CVEs that affect this product version, as a CPE 2.3 name, for example cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:\* or cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:\*. ## `knownExploitedOnly` (type: `boolean`): Only return CVEs listed in CISA's Known Exploited Vulnerabilities catalog, the ones attackers are actively using. ## `publishedFrom` (type: `string`): Only return CVEs published on or after this date, for example 2026-01-01. Ranges of any length work. ## `publishedTo` (type: `string`): Only return CVEs published on or before this date, for example 2026-06-30. ## `modifiedFrom` (type: `string`): Only return CVEs last modified on or after this date, for example 2026-10-01. Use it to pick up re-scored and re-analysed CVEs. ## `modifiedTo` (type: `string`): Only return CVEs last modified on or before this date, for example 2026-10-31. ## `maxItems` (type: `integer`): Maximum number of CVEs to return per URL or keyword search. Leave empty for every matching CVE. ## `apiKey` (type: `string`): Optional free NVD API key, for example 0a1b2c3d-.... It raises the NVD rate limit tenfold (50 instead of 5 requests per 30 seconds), which matters for long CVE id lists and large searches. Request one at https://nvd.nist.gov/developers/request-an-api-key. ## `proxyConfiguration` (type: `object`): Proxy settings. The NVD is public and needs no proxy; the Actor keeps to the NVD's request-rate limit. ## Actor input object example ```json { "startUrls": [ { "url": "https://nvd.nist.gov/vuln/search?resultType=records&keyword=apache&cisaKev=true" } ], "cveIds": [ "CVE-2021-44228" ], "knownExploitedOnly": false, "maxItems": 5, "proxyConfiguration": { "useApifyProxy": false } } ``` # Actor output Schema ## `overview` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "startUrls": [ { "url": "https://nvd.nist.gov/vuln/search?resultType=records&keyword=apache&cisaKev=true" } ], "cveIds": [ "CVE-2021-44228" ], "maxItems": 5 }; // Run the Actor and wait for it to finish const run = await client.actor("anyxsolutions/nvd-cve-scraper").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "startUrls": [{ "url": "https://nvd.nist.gov/vuln/search?resultType=records&keyword=apache&cisaKev=true" }], "cveIds": ["CVE-2021-44228"], "maxItems": 5, } # Run the Actor and wait for it to finish run = client.actor("anyxsolutions/nvd-cve-scraper").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "startUrls": [ { "url": "https://nvd.nist.gov/vuln/search?resultType=records&keyword=apache&cisaKev=true" } ], "cveIds": [ "CVE-2021-44228" ], "maxItems": 5 }' | apify call anyxsolutions/nvd-cve-scraper --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,anyxsolutions/nvd-cve-scraper" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/lrAeoYmWTgmwWfQsd/builds/3gpZc6hXjQT4L2K3F/openapi.json