# NIST NVD CVE Vulnerability Records (`automation-lab/nist-nvd-cve-vulnerability-records`) Actor

Query and bulk-export official NIST NVD CVE 2.0 records by ID, keyword, severity, CWE, CPE, publication window, modification window, or CISA KEV status.

- **URL**: https://apify.com/automation-lab/nist-nvd-cve-vulnerability-records.md
- **Developed by:** [Stas Persiianenko](https://apify.com/automation-lab) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.26 / 1,000 cve-record extracteds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## NIST NVD CVE Vulnerability Records

Query and bulk-export official **NIST NVD** CVE 2.0 records for vulnerability research, security inventory enrichment, and recurring intelligence refreshes.

The Actor calls the public NVD API directly and returns both analysis-friendly fields and the complete source CVE object. Each dataset row includes descriptions, CVSS metrics, CWE weaknesses, affected CPE configurations, references, CISA KEV metadata, publication time, and modification time.

### What can this NVD Actor do?

- Retrieve one or many exact CVE IDs.
- Search CVE descriptions by keyword or phrase.
- Filter by exact CVSS v3 severity, CWE ID, or CPE 2.3 name.
- Export only CISA Known Exploited Vulnerabilities.
- Export CVEs published within a bounded date window.
- Refresh records modified within a bounded date window.
- Paginate official NVD CVE 2.0 results up to your `maxItems` limit.
- Preserve the complete source record for forward-compatible processing.
- Produce normalized CVSS, CWE, CPE, reference, and KEV fields for tables and pipelines.

No browser or proxy is used. An NVD API key is not required for normal runs.

### Who is it for?

#### Vulnerability management teams

Refresh local vulnerability inventories and identify CVEs whose NVD analysis changed since the previous scheduled run.

#### SOC and threat-intelligence analysts

Export severity, CISA KEV, weakness, affected-product, and reference context for triage and investigation.

#### DevSecOps and application security teams

Enrich scanner findings by exact CVE ID and send consistent records to data warehouses, ticketing systems, or remediation dashboards.

#### Security researchers and data engineers

Create reproducible NVD extracts without implementing API pagination, anonymous rate limits, date validation, deduplication, and record normalization.

### Why use this Actor instead of a raw NVD API request?

The NVD API is the authoritative source, but production workflows still need input validation, bounded retries, pagination, deduplication, dataset storage, scheduling, integrations, and stable normalized fields.

This Actor provides those operational pieces while retaining `rawNvdRecord`. You can use concise fields immediately and still access newly introduced NVD properties before the normalized contract is expanded.

### What NVD data is extracted?

| Field | Meaning |
| --- | --- |
| `cveId` | Official CVE identifier |
| `description` / `descriptions` | Preferred English description and all supplied languages |
| `published` | NVD publication timestamp |
| `lastModified` | Latest NVD modification timestamp |
| `vulnStatus` | Current NVD analysis status |
| `highestCvss*` | Selected primary score, severity, version, and vector |
| `cvssMetrics` | Normalized CVSS metrics across available versions and sources |
| `cweIds` / `weaknesses` | Flat CWE identifiers and complete weakness objects |
| `affectedCpes` | Flattened CPE criteria and affected version boundaries |
| `configurations` | Complete nested NVD configuration expressions |
| `references` / `referenceUrls` | Tagged reference objects and flat URLs |
| `hasCisaKev` | Whether CISA KEV metadata is present |
| `cisa*` | KEV date, due date, action, and vulnerability name |
| `evaluator*` | NVD evaluator notes when supplied |
| `vendorComments` | Vendor comments when present |
| `nvdUrl` | Public NVD CVE detail link |
| `retrievedAt` | UTC retrieval timestamp |
| `rawNvdRecord` | Complete source CVE 2.0 object |

Fields can be null or empty when NVD does not supply that analysis.

### Getting started

1. Open the Actor in Apify Console.
2. Keep the prefilled `CVE-2021-44228` lookup or clear CVE IDs to use filters.
3. Choose a practical `maxItems` limit.
4. Click **Start**.
5. Open the **Dataset** tab to inspect, download, or integrate the results.
6. Save the run as a Task if you want to schedule a modification-window refresh.

### Input parameters

| Input | Type | Default | Notes |
| --- | --- | --- | --- |
| `cveIds` | string array | `CVE-2021-44228` prefill | Exact lookup mode; at most 500 IDs; cannot be combined with filters |
| `keywordSearch` | string | — | Matches words or a phrase in CVE descriptions |
| `cvssV3Severity` | enum | any | Exact `LOW`, `MEDIUM`, `HIGH`, or `CRITICAL` |
| `cweId` | string | — | Official form such as `CWE-79` |
| `cpeName` | string | — | NVD-supported CPE 2.3 name |
| `hasKev` | boolean | `false` | Return only records with CISA KEV metadata |
| `publishedStart` / `publishedEnd` | dates | — | Paired `YYYY-MM-DD` values, up to 120 days |
| `modifiedStart` / `modifiedEnd` | dates | — | Paired `YYYY-MM-DD` values, up to 120 days |
| `maxItems` | integer | `100` | Save from 1 to 10,000 unique CVEs |

Exact CVE IDs are intentionally a separate mode. Clear the prefilled list before entering search filters.

### Example: exact CVE lookup

```json
{
  "cveIds": ["CVE-2021-44228"],
  "maxItems": 1
}
```

This is useful for scanner enrichment or incident investigation.

### Example: NVD keyword search

```json
{
  "cveIds": [],
  "keywordSearch": "Apache Log4j",
  "maxItems": 25
}
```

Use a focused phrase to keep results relevant and runtime short.

### Example: recurring modification refresh

```json
{
  "cveIds": [],
  "modifiedStart": "2026-08-11",
  "modifiedEnd": "2026-08-11",
  "maxItems": 1000
}
```

Schedule a Task and advance both dates for each refresh interval. Store the current `lastModified` value downstream to compare changes.

### Example output

The following abbreviated fields come from a real exact-ID run. Large nested arrays and `rawNvdRecord` are omitted here only for readability.

```json
{
  "cveId": "CVE-2021-44228",
  "sourceIdentifier": "security@apache.org",
  "published": "2021-12-10T10:15:09.143",
  "lastModified": "2026-08-11T19:33:44.513",
  "vulnStatus": "Analyzed",
  "highestCvssScore": 10,
  "highestCvssSeverity": "CRITICAL",
  "highestCvssVersion": "3.1",
  "cweIds": ["CWE-20", "CWE-400", "CWE-502", "CWE-917"],
  "hasCisaKev": true,
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
}
```

### How much does it cost to export NIST NVD CVE records?

The Actor uses pay-per-event pricing:

- a **$0.005 start fee** per run;
- **$0.0021 per saved CVE record** at the Bronze tier;
- lower per-record prices on higher platform tiers.

Approximate Bronze-tier examples:

| Useful output | CVE-record event charge (plus the $0.005 start fee) |
| ---: | ---: |
| 1 CVE | $0.0021 |
| 25 CVEs | $0.0525 |
| 100 CVEs | $0.210 |
| 1,000 CVEs | $2.10 |

Only records accepted into the dataset are charged as `cve-record`. Empty results do not incur record charges. Platform tier and Apify usage may affect the final total shown in Console.

### Scheduling vulnerability-intelligence refreshes

Use `modifiedStart` and `modifiedEnd` rather than publication dates when your goal is to detect NVD analysis changes. A CVE can receive new CVSS, CPE, reference, CWE, or status information long after publication.

A practical workflow is:

1. Run a daily or weekly Task with a date window.
2. Export the dataset to your warehouse or queue.
3. Upsert by `cveId`.
4. Compare `lastModified` or the source object with the stored version.
5. Trigger remediation review only when relevant fields changed.

NVD limits one date-filter request window to 120 consecutive days. Split larger historical backfills into multiple runs.

### NVD API limits and reliability

Anonymous NVD access has a lower upstream request allowance. The Actor waits 6.5 seconds between anonymous page or exact-ID requests and retries transient 429/5xx/network failures with bounded backoff.

A single search page can return up to 2,000 records, so most focused queries need only one request. Very large exports take longer because the Actor respects the source rate limit.

For an organization-owned NVD API key, set `NVD_API_KEY` as an Actor environment variable rather than putting it in run input. Do not expose credentials in shared Tasks or logs.

Deterministic upstream 4xx responses fail instead of being retried blindly. Review the run log and simplify incompatible filter combinations if NVD rejects a query.

### Export and integration patterns

The default Apify dataset supports JSON, JSONL, CSV, Excel, XML, and RSS exports. Nested source fields are best preserved in JSON or JSONL.

Common workflows include:

- Apify Schedule → dataset → webhook → SIEM or SOAR;
- exact CVE IDs from a scanner → Actor → enriched remediation tickets;
- daily modification window → warehouse upsert by `cveId`;
- CISA KEV filter → priority vulnerability dashboard;
- CWE or CPE filter → product-specific research export.

### Use the Actor through the Apify API

Replace `YOUR_TOKEN` with an Apify API token.

#### cURL

```bash
curl -X POST \
  "https://api.apify.com/v2/acts/automation-lab~nist-nvd-cve-vulnerability-records/runs?token=YOUR_TOKEN&waitForFinish=120" \
  -H "Content-Type: application/json" \
  -d '{"cveIds":["CVE-2021-44228"],"maxItems":1}'
```

#### JavaScript

```javascript
import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('automation-lab/nist-nvd-cve-vulnerability-records').call({
  cveIds: ['CVE-2021-44228'],
  maxItems: 1,
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items[0].cveId, items[0].highestCvssScore);
```

#### Python

```python
from apify_client import ApifyClient

client = ApifyClient("YOUR_TOKEN")
run = client.actor("automation-lab/nist-nvd-cve-vulnerability-records").call(
    run_input={"cveIds": ["CVE-2021-44228"], "maxItems": 1}
)
items = client.dataset(run["defaultDatasetId"]).list_items().items
print(items[0]["cveId"], items[0]["highestCvssScore"])
```

### Use with MCP and AI assistants

#### Claude Code setup

Add the Actor to Claude Code through Apify MCP:

```bash
claude mcp add --transport http apify \
  "https://mcp.apify.com?tools=automation-lab/nist-nvd-cve-vulnerability-records"
```

#### Claude Desktop, Cursor, and VS Code setup

Use this equivalent JSON MCP configuration in Claude Desktop, Cursor, or VS Code:

```json
{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com?tools=automation-lab/nist-nvd-cve-vulnerability-records"
    }
  }
}
```

Example prompts:

- “Fetch the current NVD record for CVE-2021-44228 and summarize CVSS and affected CPEs.”
- “Export critical CISA KEV CVEs modified in this date window.”
- “Find NVD records for this CPE and return CWE IDs and vendor advisory links.”

AI-generated summaries are not a substitute for reviewing the source fields and references.

### Legality and responsible use

NVD CVE records are public United States government vulnerability data. Use them for authorized security, research, compliance, and defensive automation.

A CVE record does not prove that a particular deployed system is exploitable. Evaluate product versions, configurations, vendor guidance, compensating controls, and current threat intelligence before making remediation or disclosure decisions.

Respect NVD service limits. Do not configure overlapping high-frequency Tasks that generate unnecessary load.

### Limitations

- Results reflect the NVD API at retrieval time and can change later.
- NVD enrichment may lag the original CVE publication or vendor advisory.
- Not every record has CVSS, CWE, CPE, reference tags, or CISA KEV fields.
- `cvssV3Severity` is an exact upstream filter, not a minimum threshold.
- Date endpoints must be paired and cannot span more than 120 days.
- Exact CVE IDs cannot be combined with search filters in one run.
- Large anonymous exports wait between NVD API pages.
- The Actor does not scan systems, prove exploitability, issue alerts, or apply patches.

### Troubleshooting

#### Why did my filtered run fail immediately?

Check that both dates in each window are present, use `YYYY-MM-DD`, and span at most 120 days. Clear the prefilled `cveIds` before using filters. Use an official `CWE-123` form and a valid CPE 2.3 string.

#### Why did the run return zero records?

The query may have no current NVD matches. Remove filters one at a time, verify an exact CVE ID on the NVD website, and check that the date window targets publication or modification time as intended.

#### Why is a large run slow?

The Actor deliberately respects anonymous NVD request limits. Reduce `maxItems`, narrow the query, split historical periods, or configure an organization-owned NVD API key as `NVD_API_KEY`.

#### Which export format should I use?

Use JSON or JSONL to preserve nested metrics, configurations, references, and the complete raw source record. CSV is convenient for the flattened summary fields but serializes nested arrays.

### FAQ

#### Does this scrape NVD web pages?

No. It queries the official structured NVD CVE 2.0 API and adds Apify scheduling, storage, billing, retry, and integration behavior.

#### Is an NVD API key required?

No. Anonymous runs work with conservative request spacing. An optional environment-level key can improve upstream allowance for authorized bulk workflows.

#### Can I export all NVD history in one run?

The Actor allows up to 10,000 records per run, but NVD date queries allow 120-day windows. Use multiple bounded Tasks for a complete historical backfill.

#### Are records charged if NVD finds nothing?

No `cve-record` event is charged for an empty result. The one-time run start event still applies.

#### Can I monitor CVE changes?

Use a scheduled Task with modification dates and compare each result to your stored record. The Actor exports refresh data; it does not maintain state or send alerts by itself.

### Related Automation Lab Actors

- [EPSS CVE Risk Enricher](https://apify.com/automation-lab/epss-cve-risk-enricher) adds exploit-prediction probability and percentile signals to CVE IDs.

Use this NVD Actor for authoritative vulnerability records and the EPSS Actor when you also need prioritization signals from the separate FIRST EPSS dataset.

# Actor input Schema

## `cveIds` (type: `array`):

Specific CVE identifiers to retrieve. This dedicated lookup mode cannot be combined with search filters.

## `keywordSearch` (type: `string`):

Words or an exact phrase to match in NVD CVE descriptions.

## `cvssV3Severity` (type: `string`):

Return records with this exact CVSS v3 severity.

## `cweId` (type: `string`):

Filter by a weakness identifier such as CWE-79.

## `cpeName` (type: `string`):

Filter by an official CPE 2.3 product name. A partial CPE must include values through the part, vendor, product and version components required by NVD.

## `hasKev` (type: `boolean`):

When enabled, return only CVEs present in the CISA Known Exploited Vulnerabilities catalog.

## `publishedStart` (type: `string`):

First publication date in YYYY-MM-DD format. Requires Published to and supports windows up to 120 days.

## `publishedEnd` (type: `string`):

Last publication date in YYYY-MM-DD format. Requires Published from.

## `modifiedStart` (type: `string`):

First NVD modification date in YYYY-MM-DD format. Requires Modified to and supports windows up to 120 days.

## `modifiedEnd` (type: `string`):

Last NVD modification date in YYYY-MM-DD format. Requires Modified from.

## `maxItems` (type: `integer`):

Maximum number of unique CVE records to save. Large anonymous exports are rate-limited by NVD between pages.

## Actor input object example

```json
{
  "cveIds": [
    "CVE-2021-44228"
  ],
  "cvssV3Severity": "",
  "hasKev": false,
  "maxItems": 1
}
```

# Actor output Schema

## `dataset` (type: `string`):

Query results in the default dataset.

## `overview` (type: `string`):

Key CVE, severity, weakness, freshness, and source-link fields.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "cveIds": [
        "CVE-2021-44228"
    ],
    "maxItems": 1
};

// Run the Actor and wait for it to finish
const run = await client.actor("automation-lab/nist-nvd-cve-vulnerability-records").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "cveIds": ["CVE-2021-44228"],
    "maxItems": 1,
}

# Run the Actor and wait for it to finish
run = client.actor("automation-lab/nist-nvd-cve-vulnerability-records").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "cveIds": [
    "CVE-2021-44228"
  ],
  "maxItems": 1
}' |
apify call automation-lab/nist-nvd-cve-vulnerability-records --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,automation-lab/nist-nvd-cve-vulnerability-records"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/vaWa74bMpiMFU8Eb2/builds/mh7zRvNFNQEISrVAB/openapi.json