# CVE Vulnerability Search: NVD records with exploit status (`bepolabs/cve-vulnerabilities`) Actor Search NVD by CVE id, keyword or CPE name: CVSS score, severity, CWE, affected versions and CISA KEV exploited flag as JSON or CSV. - **URL**: https://apify.com/bepolabs/cve-vulnerabilities.md - **Developed by:** [BEPO Labs](https://apify.com/bepolabs) (community) - **Categories:** Developer tools, Business, AI - **Security:** Limited permissions - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing $1.00 / 1,000 cves This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event ## What's an Apify Actor? An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md. ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run. For examples already wired to this Actor's own input schema, see the [API](#api) section below. Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`). # README ### 🛡️ What is CVE Vulnerability Search? Turn the National Vulnerability Database (NVD) into a clean CVE table you can sort and watch. Ask for single ids, scan the text for a vendor, or list what arrived in the last days. Each result comes back as one flat row with its ranking, weakness type, whether the US cyber agency calls it actively abused (plus the deadline to fix it), the impacted vendors and release details, and the patch, advisory and proof-of-concept pages. This product uses the NVD API but is not endorsed or certified by the NVD. - **Vulnerability management**: check the CVEs that hit your stack, sorted newest first, with severity and fix links - **Daily CVE alerts**: schedule a run with `lastDays: 1` and your products as CPE names, and send new CVEs to Slack or email - **Patch prioritisation**: filter to CISA known-exploited CVEs (KEV) and work through their due dates first - **Security reports and audits**: export CVSS, CWE and affected products of any CVE list to Excel or Google Sheets - **AI security agents**: let Claude or ChatGPT look up CVEs through MCP instead of reading NVD pages ![CVE Vulnerability Search: Official NVD records by CVE id, keyword or product: CVSS, CWE, CISA known-exploited flag and fix links.](https://api.apify.com/v2/key-value-stores/wdeAWGooHdIhvFgSY/records/cve-vulnerabilities-hero.png) #### ✨ Why use this Actor? - ✅ **Official source**: straight from the NVD CVE API 2.0 of NIST, no third-party copy - ✅ **The rating that matters**: the newest CVSS version available (4.0, 3.1, 3.0, then 2.0), NVD's own value before the reporter's - ✅ **Known exploited at a glance**: KEV flag, date added, deadline and required step on every row, plus CISA's SSVC exploitation status - ✅ **Latest on top**: NVD answers oldest first; the Actor jumps to the end, so a cap of 100 gives you the 100 newest - ✅ **One row per CVE**: a CVE found by two of your queries is merged and charged once - ✅ **Within NVD's limits**: requests spaced to NVD's 5 per 30 s (50 with your free key), retries with backoff ### 📦 What data can you get with CVE Vulnerability Search? | | | | |---|---|---| | 🆔 CVE id and NVD link | 📅 Published and last modified | 🔢 CVSS score, version and vector | | 🚦 Severity (LOW to CRITICAL) | 🌐 Attack vector | 🧩 CWE weaknesses | | 🔥 CISA known exploited (KEV) | ⏰ KEV date added and action due | 🏢 Affected vendors and products | | 📦 Affected versions (CPE ranges) | 🩹 Patch, advisory and exploit links | 📝 Description and status | ### 🚀 How to use CVE Vulnerability Search CVE Vulnerability Search works in a few clicks, no coding needed: 1. [Create a free Apify account](https://console.apify.com/sign-up) (the free plan includes 5 USD of monthly credit). 2. Open [CVE Vulnerability Search](https://apify.com/bepolabs/cve-vulnerabilities) and click **Try for free**. 3. Enter CVE ids, keywords or CPE product names, or only `lastDays` for the newest CVEs. Add a severity or known-exploited filter if you like. 4. Click **Start** and wait for the run to finish (most runs take seconds). 5. Download your data as JSON, CSV, Excel, XML or HTML, or send it straight to Google Sheets, Make, Zapier or your AI agent. ![How CVE Vulnerability Search works](https://api.apify.com/v2/key-value-stores/wdeAWGooHdIhvFgSY/records/cve-vulnerabilities-workflow.png) ### ⬇️ Input Give CVE ids, keywords, CPE names, or just a number of days. Up to 100 of them together per run; everything else is optional. ##### CVE id, keyword or CPE? A **CVE id** (`CVE-2021-44228`) returns that record. A **keyword** (`fortinet vpn`) searches the description text; all its words must appear. A **CPE name** (`cpe:2.3:a:apache:log4j`) matches NVD's list of affected products, and a prefix covers every version. ##### The newest CVEs Set `lastDays` alone (1 to 120) to list the newest CVEs, for example the critical ones of the last 7 days. With keywords or CPEs it limits them to that window. CVE id lookups ignore it. ##### Quicker with a free key Anonymous access gets 5 requests per 30 seconds, so the Actor pauses 6.5 s between calls. A free NVD API key (`apiKey`) raises it to 50, about ten times quicker for large runs. | Field | Type | What it does | Default | |---|---|---|---| | **CVE ids** (`cveIds`) | array | Look up these CVEs, e.g. | `["CVE-2021-44228"]` | | **Keywords** (`keywords`) | array | Words searched in the CVE descriptions, e.g. | | | **CPE names** (`cpes`) | array | Products as CPE 2.3 names; a prefix matches all versions, e.g. | | | **Published in the last days** (`lastDays`) | integer | Keep CVEs published in the last N days (1 to 120, NVD's window). | `30` | | **CVSS v3 severity** (`severity`) | string | Keep only CVEs of this CVSS v3 severity (keywords, CPEs and the newest list). | | | **Only known exploited (CISA KEV)** (`kevOnly`) | boolean | Keep only CVEs on CISA's Known Exploited Vulnerabilities catalog. | `false` | | **Maximum CVEs per query** (`maxResultsPerQuery`) | integer | Cap per keyword or CPE, newest first. | `100` | | **Maximum references per CVE** (`maxReferences`) | integer | Reference links kept in `references`; patch, advisory and exploit links are always complete. | `20` | | **NVD API key (optional)** (`apiKey`) | string | Free key from nvd.nist.gov/developers/request-an-api-key: 50 requests per 30 s instead of 5, so large runs finish about ten times quicker. | | | **Maximum retries** (`maxRetries`) | integer | Retries per request with exponential backoff on network errors, 429 and 5xx. | `3` | ![CVE Vulnerability Search input form](https://api.apify.com/v2/key-value-stores/wdeAWGooHdIhvFgSY/records/cve-vulnerabilities-input.png) #### Input example ```json { "cveIds": [ "CVE-2021-44228", "CVE-2023-4863", "CVE-2099-0001" ] } ``` ### ⬆️ Output Every CVE becomes one row with the same fields, newest first. The run summary in the key-value store (`OUTPUT`) lists every query with its total matches at NVD, how many rows it gave and any error. ![CVE Vulnerability Search output table](https://api.apify.com/v2/key-value-stores/wdeAWGooHdIhvFgSY/records/cve-vulnerabilities-output.png) #### Output example One row of the dataset (CVE-2021-44228, Log4Shell; long lists shortened): ```json { "cveId": "CVE-2021-44228", "cvssScore": 10, "severity": "CRITICAL", "cisaKev": true, "exploitation": "active", "published": "2021-12-10", "attackVector": "NETWORK", "query": "CVE-2021-44228", "queryType": "cveId", "lastModified": "2026-08-11", "status": "Analyzed", "description": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.", "cvssVersion": "3.1", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "exploitabilityScore": 3.9, "impactScore": 6, "cvssSource": "nvd@nist.gov", "cwes": [ "CWE-20", "CWE-400", "CWE-502", "CWE-917" ], "cisaExploitAdded": "2021-12-10", "cisaActionDue": "2021-12-24", "cisaVulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability", "vendors": [ "siemens", "apache", "intel", "debian" ], "products": [ "apache:log4j", "siemens:6bk1602-0aa12-0tp0_firmware", "siemens:6bk1602-0aa22-0tp0_firmware", "siemens:6bk1602-0aa32-0tp0_firmware" ], "affectedCpes": [ { "cpe": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*", "part": "application", "vendor": "apache", "product": "log4j", "version": null, "versionStartIncluding": "2.0.1", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "2.3.1" } ], "affectedCpeCount": 373, "patchUrls": [ "https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/", "https://www.oracle.com/security-alerts/cpuapr2022.html" ], "advisoryUrls": [ "https://logging.apache.org/log4j/2.x/security.html" ], "exploitUrls": [ "http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html" ], "referenceCount": 103, "assigner": "security@apache.org", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" } ``` #### ⚠️ Queries without results or with errors A search that finds nothing, such as a CVE id NVD does not know, returns no row and is not an error. A failing one (NVD down, rate limit after all retries) gives no result either: the run goes on with the next entry, the log and `OUTPUT` name it and the reason, and it costs zero. The run stops with failure only when none was answered. | Case | What you see | |---|---| | Unknown CVE id | 0 rows for that query in `OUTPUT`, run succeeds | | `HTTP 403` / `HTTP 429` | NVD refused or rate-limited after all retries; add a free API key | | `HTTP 5xx` | NVD is down; the query is named in `OUTPUT`, try again later | View the results as a table or JSON in the Output tab and download them as JSON, CSV, Excel, XML, HTML or RSS, all fields or only those you pick. ### 💰 How much does CVE Vulnerability Search cost? CVE Vulnerability Search is priced **per event**: **1 USD per 1,000 CVEs** (0.001 USD each), with no monthly rental. A CVE found by two queries is counted once; ones that fail or return empty cost zero. | You get | You pay | |---|---| | 100 CVEs | 0.1 USD | | 1,000 CVEs | 1 USD | | 10,000 CVEs | 10 USD | | 100,000 CVEs | 100 USD | 💡 Apify's free plan gives you 5 USD of credit every month, enough for about **5,000 CVEs** at no cost. Set a spending limit per run and the Actor stops there. ### ⚖️ CVE Vulnerability Search vs. the alternatives | | CVE Vulnerability Search | NVD website search | Typical CVE scrapers | |---|---|---|---| | **Ids, keywords, CPE and last-days in one run** | ✅ | one search at a time | often one mode | | **CISA known-exploited flag and due date** | ✅ on every row | on the detail page | often missing | | **Newest CVEs first with a cap** | ✅ | ✅ | often oldest first | | **Patch, advisory and exploit links split out** | ✅ | one reference list | ❌ | | **Export, schedule, API and MCP** | ✅ | ❌ | ✅ | ### 🔌 Integrations, API and MCP #### Connect CVE Vulnerability Search to your AI agent (MCP) Give Claude, ChatGPT, Cursor or any MCP client direct access to CVE Vulnerability Search through the [Apify MCP server](https://mcp.apify.com). Add this URL to its settings: ```text https://mcp.apify.com/?actors=bepolabs/cve-vulnerabilities ``` For Claude Desktop, add it under `mcpServers` in `claude_desktop_config.json`: ```json { "mcpServers": { "cve-vulnerabilities": { "command": "npx", "args": [ "-y", "@apify/actors-mcp-server", "--actors", "bepolabs/cve-vulnerabilities" ], "env": { "APIFY_TOKEN": "" } } } } ``` Then ask: *"List the critical CVEs published in the last 7 days and tell me which are on CISA's known exploited catalogue."* #### Run it from your code Python (`pip install apify-client`): ```python from apify_client import ApifyClient client = ApifyClient("") run = client.actor("bepolabs/cve-vulnerabilities").call(run_input={"cveIds":["CVE-2021-44228","CVE-2023-4863","CVE-2099-0001"]}) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) ``` JavaScript (`npm install apify-client`): ```javascript import { ApifyClient } from 'apify-client'; const client = new ApifyClient({ token: '' }); const run = await client.actor('bepolabs/cve-vulnerabilities').call({"cveIds":["CVE-2021-44228","CVE-2023-4863","CVE-2099-0001"]}); const { items } = await client.dataset(run.defaultDatasetId).listItems(); console.log(items); ``` #### No-code integrations Send results to **Google Sheets, Slack, Airtable, HubSpot, Make, Zapier, n8n** and more from the Integrations tab, start runs on a **schedule**, or trigger your own endpoint with a **webhook** when a run finishes. The [Apify API](https://docs.apify.com/api/v2) gives you full control over runs and datasets. ### ❓ FAQ ##### Why does a new CVE have no score? NVD analyses new CVEs over days to weeks. Until then `status` is Awaiting Analysis and the CVSS fields hold the reporter's score, or stay empty. ##### Keyword or CPE: which should I use? A keyword searches the description text and finds every mention. A CPE name matches NVD's list of affected products and versions: exact, but only for CVEs NVD has analysed. ##### How do I get a daily CVE alert? Schedule the Actor daily with `lastDays: 1`, your products as CPE names or keywords, and an integration to Slack, email or Google Sheets. ##### Do I need an NVD API key? No. Without one the Actor stays inside NVD's limit of 5 requests per 30 seconds. A free key makes large runs about ten times quicker. ##### How many CVEs can I get? Up to 10,000 per keyword or CPE (`maxResultsPerQuery`, default 100), up to 100 queries per run. ##### Is it legal to use CVE Vulnerability Search? Yes. NVD data is a public service of NIST, free to use, and the Actor stays within NVD's published rate limits. As NVD asks: this product uses the NVD API but is not endorsed or certified by the NVD. Every run's `OUTPUT` carries the same notice. ##### What if something is missing or does not work? Open an issue on the **Issues** tab; we read each one and reply. Feature requests are welcome too. ### 💬 Your feedback Tell us what CVE Vulnerability Search should add on the **Issues** tab or leave a review; your notes decide what we work on next. ### 🔗 Related Actors | Actor | What it does | |---|---| | 🏛️ [SEC EDGAR Filings](https://apify.com/bepolabs/sec-edgar) | Tickers or CIK numbers to SEC filings: 10-K, 10-Q, 8-K, Form 4 and any other form, with document links. | | 🌐 [Domain RDAP and DNS](https://apify.com/bepolabs/domain-rdap) | Domains to registrar, creation and expiry dates, age, status, nameservers, DNSSEC and DNS records from official RDAP, in bulk. | | 🟧 [Hacker News Search](https://apify.com/bepolabs/hacker-news) | Hacker News stories, comments, Ask HN, Show HN and jobs for any search, with points, comment count, date and text. | | 🧩 [Tech Stack Detector](https://apify.com/bepolabs/tech-stack) | Any list of domains to the technologies behind each site: CMS, shop, framework, analytics, CDN and hosting. | | 🌦️ [US Weather Forecast](https://apify.com/bepolabs/us-weather) | Official National Weather Service forecasts, hourly and 7-day, plus active weather alerts for any US point or state. | # Changelog This Actor's version history is a separate document: https://apify.com/bepolabs/cve-vulnerabilities/changelog.md # Actor input Schema ## `cveIds` (type: `array`): Look up these CVEs, e.g. CVE-2021-44228. ## `keywords` (type: `array`): Words searched in the CVE descriptions, e.g. log4j, fortinet vpn, wordpress plugin. All words of one keyword must appear. ## `cpes` (type: `array`): Products as CPE 2.3 names; a prefix matches all versions, e.g. cpe:2.3:a:apache:log4j or cpe:2.3:o:microsoft:windows_11. ## `lastDays` (type: `integer`): Keep CVEs published in the last N days (1 to 120, NVD's window). Alone, without ids, keywords or CPEs, it lists the newest CVEs. CVE id lookups ignore it. ## `severity` (type: `string`): Keep only CVEs of this CVSS v3 severity (keywords, CPEs and the newest list). ## `kevOnly` (type: `boolean`): Keep only CVEs on CISA's Known Exploited Vulnerabilities catalog. ## `maxResultsPerQuery` (type: `integer`): Cap per keyword or CPE, newest first. ## `maxReferences` (type: `integer`): Reference links kept in `references`; patch, advisory and exploit links are always complete. ## `apiKey` (type: `string`): Free key from nvd.nist.gov/developers/request-an-api-key: 50 requests per 30 s instead of 5, so large runs finish about ten times quicker. ## `maxRetries` (type: `integer`): Retries per request with exponential backoff on network errors, 429 and 5xx. ## Actor input object example ```json { "cveIds": [ "CVE-2021-44228" ], "lastDays": 30, "kevOnly": false, "maxResultsPerQuery": 100, "maxReferences": 20, "maxRetries": 3 } ``` # Actor output Schema ## `results` (type: `string`): Dataset items, one row per result, in the overview table view. # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "cveIds": [ "CVE-2021-44228" ], "lastDays": 30 }; // Run the Actor and wait for it to finish const run = await client.actor("bepolabs/cve-vulnerabilities").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "cveIds": ["CVE-2021-44228"], "lastDays": 30, } # Run the Actor and wait for it to finish run = client.actor("bepolabs/cve-vulnerabilities").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "cveIds": [ "CVE-2021-44228" ], "lastDays": 30 }' | apify call bepolabs/cve-vulnerabilities --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,bepolabs/cve-vulnerabilities" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/NngMeXccDIQOQgdFa/builds/VMoAn08mTAk0UGqkV/openapi.json