CVE Vulnerability Search: NVD records with exploit status

🛡️ What is CVE Vulnerability Search?

Turn the National Vulnerability Database (NVD) into a clean CVE table you can sort and watch. Ask for single ids, scan the text for a vendor, or list what arrived in the last days. Each result comes back as one flat row with its ranking, weakness type, whether the US cyber agency calls it actively abused (plus the deadline to fix it), the impacted vendors and release details, and the patch, advisory and proof-of-concept pages. This product uses the NVD API but is not endorsed or certified by the NVD.

• Vulnerability management: check the CVEs that hit your stack, sorted newest first, with severity and fix links
• Daily CVE alerts: schedule a run with lastDays: 1 and your products as CPE names, and send new CVEs to Slack or email
• Patch prioritisation: filter to CISA known-exploited CVEs (KEV) and work through their due dates first
• Security reports and audits: export CVSS, CWE and affected products of any CVE list to Excel or Google Sheets
• AI security agents: let Claude or ChatGPT look up CVEs through MCP instead of reading NVD pages

✨ Why use this Actor?

• ✅ Official source: straight from the NVD CVE API 2.0 of NIST, no third-party copy
• ✅ The rating that matters: the newest CVSS version available (4.0, 3.1, 3.0, then 2.0), NVD's own value before the reporter's
• ✅ Known exploited at a glance: KEV flag, date added, deadline and required step on every row, plus CISA's SSVC exploitation status
• ✅ Latest on top: NVD answers oldest first; the Actor jumps to the end, so a cap of 100 gives you the 100 newest
• ✅ One row per CVE: a CVE found by two of your queries is merged and charged once
• ✅ Within NVD's limits: requests spaced to NVD's 5 per 30 s (50 with your free key), retries with backoff

📦 What data can you get with CVE Vulnerability Search?

🆔 CVE id and NVD link	📅 Published and last modified	🔢 CVSS score, version and vector
🚦 Severity (LOW to CRITICAL)	🌐 Attack vector	🧩 CWE weaknesses
🔥 CISA known exploited (KEV)	⏰ KEV date added and action due	🏢 Affected vendors and products
📦 Affected versions (CPE ranges)	🩹 Patch, advisory and exploit links	📝 Description and status

🚀 How to use CVE Vulnerability Search

CVE Vulnerability Search works in a few clicks, no coding needed:

1. Create a free Apify account (the free plan includes 5 USD of monthly credit).
2. Open CVE Vulnerability Search and click Try for free.
3. Enter CVE ids, keywords or CPE product names, or only lastDays for the newest CVEs. Add a severity or known-exploited filter if you like.
4. Click Start and wait for the run to finish (most runs take seconds).
5. Download your data as JSON, CSV, Excel, XML or HTML, or send it straight to Google Sheets, Make, Zapier or your AI agent.

⬇️ Input

Give CVE ids, keywords, CPE names, or just a number of days. Up to 100 of them together per run; everything else is optional.

CVE id, keyword or CPE?

A CVE id (CVE-2021-44228) returns that record. A keyword (fortinet vpn) searches the description text; all its words must appear. A CPE name (cpe:2.3:a:apache:log4j) matches NVD's list of affected products, and a prefix covers every version.

The newest CVEs

Set lastDays alone (1 to 120) to list the newest CVEs, for example the critical ones of the last 7 days. With keywords or CPEs it limits them to that window. CVE id lookups ignore it.

Quicker with a free key

Anonymous access gets 5 requests per 30 seconds, so the Actor pauses 6.5 s between calls. A free NVD API key (apiKey) raises it to 50, about ten times quicker for large runs.

Field	Type	What it does	Default
CVE ids (cveIds)	array	Look up these CVEs, e.g.	["CVE-2021-44228"]
Keywords (keywords)	array	Words searched in the CVE descriptions, e.g.
CPE names (cpes)	array	Products as CPE 2.3 names; a prefix matches all versions, e.g.
Published in the last days (lastDays)	integer	Keep CVEs published in the last N days (1 to 120, NVD's window).	30
CVSS v3 severity (severity)	string	Keep only CVEs of this CVSS v3 severity (keywords, CPEs and the newest list).
Only known exploited (CISA KEV) (kevOnly)	boolean	Keep only CVEs on CISA's Known Exploited Vulnerabilities catalog.	false
Maximum CVEs per query (maxResultsPerQuery)	integer	Cap per keyword or CPE, newest first.	100
Maximum references per CVE (maxReferences)	integer	Reference links kept in references; patch, advisory and exploit links are always complete.	20
NVD API key (optional) (apiKey)	string	Free key from nvd.nist.gov/developers/request-an-api-key: 50 requests per 30 s instead of 5, so large runs finish about ten times quicker.
Maximum retries (maxRetries)	integer	Retries per request with exponential backoff on network errors, 429 and 5xx.	3

Input example

{
    "cveIds": [
        "CVE-2021-44228",
        "CVE-2023-4863",
        "CVE-2099-0001"
    ]
}

⬆️ Output

Every CVE becomes one row with the same fields, newest first. The run summary in the key-value store (OUTPUT) lists every query with its total matches at NVD, how many rows it gave and any error.

Output example

One row of the dataset (CVE-2021-44228, Log4Shell; long lists shortened):

{
    "cveId": "CVE-2021-44228",
    "cvssScore": 10,
    "severity": "CRITICAL",
    "cisaKev": true,
    "exploitation": "active",
    "published": "2021-12-10",
    "attackVector": "NETWORK",
    "query": "CVE-2021-44228",
    "queryType": "cveId",
    "lastModified": "2026-08-11",
    "status": "Analyzed",
    "description": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
    "cvssVersion": "3.1",
    "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
    "exploitabilityScore": 3.9,
    "impactScore": 6,
    "cvssSource": "nvd@nist.gov",
    "cwes": [
        "CWE-20",
        "CWE-400",
        "CWE-502",
        "CWE-917"
    ],
    "cisaExploitAdded": "2021-12-10",
    "cisaActionDue": "2021-12-24",
    "cisaVulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability",
    "vendors": [
        "siemens",
        "apache",
        "intel",
        "debian"
    ],
    "products": [
        "apache:log4j",
        "siemens:6bk1602-0aa12-0tp0_firmware",
        "siemens:6bk1602-0aa22-0tp0_firmware",
        "siemens:6bk1602-0aa32-0tp0_firmware"
    ],
    "affectedCpes": [
        {
            "cpe": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
            "part": "application",
            "vendor": "apache",
            "product": "log4j",
            "version": null,
            "versionStartIncluding": "2.0.1",
            "versionStartExcluding": null,
            "versionEndIncluding": null,
            "versionEndExcluding": "2.3.1"
        }
    ],
    "affectedCpeCount": 373,
    "patchUrls": [
        "https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/",
        "https://www.oracle.com/security-alerts/cpuapr2022.html"
    ],
    "advisoryUrls": [
        "https://logging.apache.org/log4j/2.x/security.html"
    ],
    "exploitUrls": [
        "http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html"
    ],
    "referenceCount": 103,
    "assigner": "security@apache.org",
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
}

⚠️ Queries without results or with errors

A search that finds nothing, such as a CVE id NVD does not know, returns no row and is not an error. A failing one (NVD down, rate limit after all retries) gives no result either: the run goes on with the next entry, the log and OUTPUT name it and the reason, and it costs zero. The run stops with failure only when none was answered.

Case	What you see
Unknown CVE id	0 rows for that query in OUTPUT, run succeeds
HTTP 403 / HTTP 429	NVD refused or rate-limited after all retries; add a free API key
HTTP 5xx	NVD is down; the query is named in OUTPUT, try again later

View the results as a table or JSON in the Output tab and download them as JSON, CSV, Excel, XML, HTML or RSS, all fields or only those you pick.

💰 How much does CVE Vulnerability Search cost?

CVE Vulnerability Search is priced per event: 1 USD per 1,000 CVEs (0.001 USD each), with no monthly rental. A CVE found by two queries is counted once; ones that fail or return empty cost zero.

You get	You pay
100 CVEs	0.1 USD
1,000 CVEs	1 USD
10,000 CVEs	10 USD
100,000 CVEs	100 USD

💡 Apify's free plan gives you 5 USD of credit every month, enough for about 5,000 CVEs at no cost. Set a spending limit per run and the Actor stops there.

⚖️ CVE Vulnerability Search vs. the alternatives

	CVE Vulnerability Search	NVD website search	Typical CVE scrapers
Ids, keywords, CPE and last-days in one run	✅	one search at a time	often one mode
CISA known-exploited flag and due date	✅ on every row	on the detail page	often missing
Newest CVEs first with a cap	✅	✅	often oldest first
Patch, advisory and exploit links split out	✅	one reference list	❌
Export, schedule, API and MCP	✅	❌	✅

🔌 Integrations, API and MCP

Connect CVE Vulnerability Search to your AI agent (MCP)

Give Claude, ChatGPT, Cursor or any MCP client direct access to CVE Vulnerability Search through the Apify MCP server. Add this URL to its settings:

https://mcp.apify.com/?actors=bepolabs/cve-vulnerabilities

For Claude Desktop, add it under mcpServers in claude_desktop_config.json:

{
    "mcpServers": {
        "cve-vulnerabilities": {
            "command": "npx",
            "args": [
                "-y",
                "@apify/actors-mcp-server",
                "--actors",
                "bepolabs/cve-vulnerabilities"
            ],
            "env": {
                "APIFY_TOKEN": "<your Apify API token>"
            }
        }
    }
}

Then ask: "List the critical CVEs published in the last 7 days and tell me which are on CISA's known exploited catalogue."

Run it from your code

Python (pip install apify-client):

from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("bepolabs/cve-vulnerabilities").call(run_input={"cveIds":["CVE-2021-44228","CVE-2023-4863","CVE-2099-0001"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

JavaScript (npm install apify-client):

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: '<YOUR_APIFY_TOKEN>' });
const run = await client.actor('bepolabs/cve-vulnerabilities').call({"cveIds":["CVE-2021-44228","CVE-2023-4863","CVE-2099-0001"]});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

No-code integrations

Send results to Google Sheets, Slack, Airtable, HubSpot, Make, Zapier, n8n and more from the Integrations tab, start runs on a schedule, or trigger your own endpoint with a webhook when a run finishes. The Apify API gives you full control over runs and datasets.

❓ FAQ

Why does a new CVE have no score?

NVD analyses new CVEs over days to weeks. Until then status is Awaiting Analysis and the CVSS fields hold the reporter's score, or stay empty.

Keyword or CPE: which should I use?

A keyword searches the description text and finds every mention. A CPE name matches NVD's list of affected products and versions: exact, but only for CVEs NVD has analysed.

How do I get a daily CVE alert?

Schedule the Actor daily with lastDays: 1, your products as CPE names or keywords, and an integration to Slack, email or Google Sheets.

Do I need an NVD API key?

No. Without one the Actor stays inside NVD's limit of 5 requests per 30 seconds. A free key makes large runs about ten times quicker.

How many CVEs can I get?

Up to 10,000 per keyword or CPE (maxResultsPerQuery, default 100), up to 100 queries per run.

Is it legal to use CVE Vulnerability Search?

Yes. NVD data is a public service of NIST, free to use, and the Actor stays within NVD's published rate limits. As NVD asks: this product uses the NVD API but is not endorsed or certified by the NVD. Every run's OUTPUT carries the same notice.

What if something is missing or does not work?

Open an issue on the Issues tab; we read each one and reply. Feature requests are welcome too.

💬 Your feedback

Tell us what CVE Vulnerability Search should add on the Issues tab or leave a review; your notes decide what we work on next.

🔗 Related Actors

Actor	What it does
🏛️ SEC EDGAR Filings	Tickers or CIK numbers to SEC filings: 10-K, 10-Q, 8-K, Form 4 and any other form, with document links.
🌐 Domain RDAP and DNS	Domains to registrar, creation and expiry dates, age, status, nameservers, DNSSEC and DNS records from official RDAP, in bulk.
🟧 Hacker News Search	Hacker News stories, comments, Ask HN, Show HN and jobs for any search, with points, comment count, date and text.
🧩 Tech Stack Detector	Any list of domains to the technologies behind each site: CMS, shop, framework, analytics, CDN and hosting.
🌦️ US Weather Forecast	Official National Weather Service forecasts, hourly and 7-day, plus active weather alerts for any US point or state.