NIST NVD CVE Vulnerability Records

Query and bulk-export official NIST NVD CVE 2.0 records for vulnerability research, security inventory enrichment, and recurring intelligence refreshes.

The Actor calls the public NVD API directly and returns both analysis-friendly fields and the complete source CVE object. Each dataset row includes descriptions, CVSS metrics, CWE weaknesses, affected CPE configurations, references, CISA KEV metadata, publication time, and modification time.

What can this NVD Actor do?

• Retrieve one or many exact CVE IDs.
• Search CVE descriptions by keyword or phrase.
• Filter by exact CVSS v3 severity, CWE ID, or CPE 2.3 name.
• Export only CISA Known Exploited Vulnerabilities.
• Export CVEs published within a bounded date window.
• Refresh records modified within a bounded date window.
• Paginate official NVD CVE 2.0 results up to your maxItems limit.
• Preserve the complete source record for forward-compatible processing.
• Produce normalized CVSS, CWE, CPE, reference, and KEV fields for tables and pipelines.

No browser or proxy is used. An NVD API key is not required for normal runs.

Who is it for?

Vulnerability management teams

Refresh local vulnerability inventories and identify CVEs whose NVD analysis changed since the previous scheduled run.

SOC and threat-intelligence analysts

Export severity, CISA KEV, weakness, affected-product, and reference context for triage and investigation.

DevSecOps and application security teams

Enrich scanner findings by exact CVE ID and send consistent records to data warehouses, ticketing systems, or remediation dashboards.

Security researchers and data engineers

Create reproducible NVD extracts without implementing API pagination, anonymous rate limits, date validation, deduplication, and record normalization.

Why use this Actor instead of a raw NVD API request?

The NVD API is the authoritative source, but production workflows still need input validation, bounded retries, pagination, deduplication, dataset storage, scheduling, integrations, and stable normalized fields.

This Actor provides those operational pieces while retaining rawNvdRecord. You can use concise fields immediately and still access newly introduced NVD properties before the normalized contract is expanded.

What NVD data is extracted?

Field	Meaning
cveId	Official CVE identifier
description / descriptions	Preferred English description and all supplied languages
published	NVD publication timestamp
lastModified	Latest NVD modification timestamp
vulnStatus	Current NVD analysis status
highestCvss*	Selected primary score, severity, version, and vector
cvssMetrics	Normalized CVSS metrics across available versions and sources
cweIds / weaknesses	Flat CWE identifiers and complete weakness objects
affectedCpes	Flattened CPE criteria and affected version boundaries
configurations	Complete nested NVD configuration expressions
references / referenceUrls	Tagged reference objects and flat URLs
hasCisaKev	Whether CISA KEV metadata is present
cisa*	KEV date, due date, action, and vulnerability name
evaluator*	NVD evaluator notes when supplied
vendorComments	Vendor comments when present
nvdUrl	Public NVD CVE detail link
retrievedAt	UTC retrieval timestamp
rawNvdRecord	Complete source CVE 2.0 object

Fields can be null or empty when NVD does not supply that analysis.

Getting started

1. Open the Actor in Apify Console.
2. Keep the prefilled CVE-2021-44228 lookup or clear CVE IDs to use filters.
3. Choose a practical maxItems limit.
4. Click Start.
5. Open the Dataset tab to inspect, download, or integrate the results.
6. Save the run as a Task if you want to schedule a modification-window refresh.

Input parameters

Input	Type	Default	Notes
cveIds	string array	CVE-2021-44228 prefill	Exact lookup mode; at most 500 IDs; cannot be combined with filters
keywordSearch	string	—	Matches words or a phrase in CVE descriptions
cvssV3Severity	enum	any	Exact LOW, MEDIUM, HIGH, or CRITICAL
cweId	string	—	Official form such as CWE-79
cpeName	string	—	NVD-supported CPE 2.3 name
hasKev	boolean	false	Return only records with CISA KEV metadata
publishedStart / publishedEnd	dates	—	Paired YYYY-MM-DD values, up to 120 days
modifiedStart / modifiedEnd	dates	—	Paired YYYY-MM-DD values, up to 120 days
maxItems	integer	100	Save from 1 to 10,000 unique CVEs

Exact CVE IDs are intentionally a separate mode. Clear the prefilled list before entering search filters.

Example: exact CVE lookup

{
  "cveIds": ["CVE-2021-44228"],
  "maxItems": 1
}

This is useful for scanner enrichment or incident investigation.

Example: NVD keyword search

{
  "cveIds": [],
  "keywordSearch": "Apache Log4j",
  "maxItems": 25
}

Use a focused phrase to keep results relevant and runtime short.

Example: recurring modification refresh

{
  "cveIds": [],
  "modifiedStart": "2026-08-11",
  "modifiedEnd": "2026-08-11",
  "maxItems": 1000
}

Schedule a Task and advance both dates for each refresh interval. Store the current lastModified value downstream to compare changes.

Example output

The following abbreviated fields come from a real exact-ID run. Large nested arrays and rawNvdRecord are omitted here only for readability.

{
  "cveId": "CVE-2021-44228",
  "sourceIdentifier": "security@apache.org",
  "published": "2021-12-10T10:15:09.143",
  "lastModified": "2026-08-11T19:33:44.513",
  "vulnStatus": "Analyzed",
  "highestCvssScore": 10,
  "highestCvssSeverity": "CRITICAL",
  "highestCvssVersion": "3.1",
  "cweIds": ["CWE-20", "CWE-400", "CWE-502", "CWE-917"],
  "hasCisaKev": true,
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
}

How much does it cost to export NIST NVD CVE records?

The Actor uses pay-per-event pricing:

• a $0.005 start fee per run;
• $0.0021 per saved CVE record at the Bronze tier;
• lower per-record prices on higher platform tiers.

Approximate Bronze-tier examples:

Useful output	CVE-record event charge (plus the $0.005 start fee)
1 CVE	$0.0021
25 CVEs	$0.0525
100 CVEs	$0.210
1,000 CVEs	$2.10

Only records accepted into the dataset are charged as cve-record. Empty results do not incur record charges. Platform tier and Apify usage may affect the final total shown in Console.

Scheduling vulnerability-intelligence refreshes

Use modifiedStart and modifiedEnd rather than publication dates when your goal is to detect NVD analysis changes. A CVE can receive new CVSS, CPE, reference, CWE, or status information long after publication.

A practical workflow is:

1. Run a daily or weekly Task with a date window.
2. Export the dataset to your warehouse or queue.
3. Upsert by cveId.
4. Compare lastModified or the source object with the stored version.
5. Trigger remediation review only when relevant fields changed.

NVD limits one date-filter request window to 120 consecutive days. Split larger historical backfills into multiple runs.

NVD API limits and reliability

Anonymous NVD access has a lower upstream request allowance. The Actor waits 6.5 seconds between anonymous page or exact-ID requests and retries transient 429/5xx/network failures with bounded backoff.

A single search page can return up to 2,000 records, so most focused queries need only one request. Very large exports take longer because the Actor respects the source rate limit.

For an organization-owned NVD API key, set NVD_API_KEY as an Actor environment variable rather than putting it in run input. Do not expose credentials in shared Tasks or logs.

Deterministic upstream 4xx responses fail instead of being retried blindly. Review the run log and simplify incompatible filter combinations if NVD rejects a query.

Export and integration patterns

The default Apify dataset supports JSON, JSONL, CSV, Excel, XML, and RSS exports. Nested source fields are best preserved in JSON or JSONL.

Common workflows include:

• Apify Schedule → dataset → webhook → SIEM or SOAR;
• exact CVE IDs from a scanner → Actor → enriched remediation tickets;
• daily modification window → warehouse upsert by cveId;
• CISA KEV filter → priority vulnerability dashboard;
• CWE or CPE filter → product-specific research export.

Use the Actor through the Apify API

Replace YOUR_TOKEN with an Apify API token.

cURL

curl -X POST \
  "https://api.apify.com/v2/acts/automation-lab~nist-nvd-cve-vulnerability-records/runs?token=YOUR_TOKEN&waitForFinish=120" \
  -H "Content-Type: application/json" \
  -d '{"cveIds":["CVE-2021-44228"],"maxItems":1}'

JavaScript

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('automation-lab/nist-nvd-cve-vulnerability-records').call({
  cveIds: ['CVE-2021-44228'],
  maxItems: 1,
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items[0].cveId, items[0].highestCvssScore);

Python

from apify_client import ApifyClient

client = ApifyClient("YOUR_TOKEN")
run = client.actor("automation-lab/nist-nvd-cve-vulnerability-records").call(
    run_input={"cveIds": ["CVE-2021-44228"], "maxItems": 1}
)
items = client.dataset(run["defaultDatasetId"]).list_items().items
print(items[0]["cveId"], items[0]["highestCvssScore"])

Use with MCP and AI assistants

Claude Code setup

Add the Actor to Claude Code through Apify MCP:

claude mcp add --transport http apify \
  "https://mcp.apify.com?tools=automation-lab/nist-nvd-cve-vulnerability-records"

Claude Desktop, Cursor, and VS Code setup

Use this equivalent JSON MCP configuration in Claude Desktop, Cursor, or VS Code:

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com?tools=automation-lab/nist-nvd-cve-vulnerability-records"
    }
  }
}

Example prompts:

• “Fetch the current NVD record for CVE-2021-44228 and summarize CVSS and affected CPEs.”
• “Export critical CISA KEV CVEs modified in this date window.”
• “Find NVD records for this CPE and return CWE IDs and vendor advisory links.”

AI-generated summaries are not a substitute for reviewing the source fields and references.

Legality and responsible use

NVD CVE records are public United States government vulnerability data. Use them for authorized security, research, compliance, and defensive automation.

A CVE record does not prove that a particular deployed system is exploitable. Evaluate product versions, configurations, vendor guidance, compensating controls, and current threat intelligence before making remediation or disclosure decisions.

Respect NVD service limits. Do not configure overlapping high-frequency Tasks that generate unnecessary load.

Limitations

• Results reflect the NVD API at retrieval time and can change later.
• NVD enrichment may lag the original CVE publication or vendor advisory.
• Not every record has CVSS, CWE, CPE, reference tags, or CISA KEV fields.
• cvssV3Severity is an exact upstream filter, not a minimum threshold.
• Date endpoints must be paired and cannot span more than 120 days.
• Exact CVE IDs cannot be combined with search filters in one run.
• Large anonymous exports wait between NVD API pages.
• The Actor does not scan systems, prove exploitability, issue alerts, or apply patches.

Troubleshooting

Why did my filtered run fail immediately?

Check that both dates in each window are present, use YYYY-MM-DD, and span at most 120 days. Clear the prefilled cveIds before using filters. Use an official CWE-123 form and a valid CPE 2.3 string.

Why did the run return zero records?

The query may have no current NVD matches. Remove filters one at a time, verify an exact CVE ID on the NVD website, and check that the date window targets publication or modification time as intended.

Why is a large run slow?

The Actor deliberately respects anonymous NVD request limits. Reduce maxItems, narrow the query, split historical periods, or configure an organization-owned NVD API key as NVD_API_KEY.

Which export format should I use?

Use JSON or JSONL to preserve nested metrics, configurations, references, and the complete raw source record. CSV is convenient for the flattened summary fields but serializes nested arrays.

FAQ

Does this scrape NVD web pages?

No. It queries the official structured NVD CVE 2.0 API and adds Apify scheduling, storage, billing, retry, and integration behavior.

Is an NVD API key required?

No. Anonymous runs work with conservative request spacing. An optional environment-level key can improve upstream allowance for authorized bulk workflows.

Can I export all NVD history in one run?

The Actor allows up to 10,000 records per run, but NVD date queries allow 120-day windows. Use multiple bounded Tasks for a complete historical backfill.

Are records charged if NVD finds nothing?

No cve-record event is charged for an empty result. The one-time run start event still applies.

Can I monitor CVE changes?

Use a scheduled Task with modification dates and compare each result to your stored record. The Actor exports refresh data; it does not maintain state or send alerts by itself.

Related Automation Lab Actors

• EPSS CVE Risk Enricher adds exploit-prediction probability and percentile signals to CVE IDs.

Use this NVD Actor for authoritative vulnerability records and the EPSS Actor when you also need prioritization signals from the separate FIRST EPSS dataset.