CVE Risk Prioritizer, from NVD, CISA KEV and EPSS data

Give it CVE IDs, or a keyword / product CPE with a date window, and get one row per CVE that joins the three official sources security teams check by hand:

• NVD API 2.0: CVSS v3.1 and v4.0 (score, severity, vector), CWE, affected products (CPE), references, NVD status
• CISA KEV catalog: exploited in the wild, date added, federal due date (and whether it is past), known ransomware use, required action
• FIRST EPSS: probability of exploitation in the next 30 days and its percentile

Each row gets a priority band (critical-now, high, medium, low), a 0-100 risk score and the plain-English reasons and formula behind them, so the result can go straight into a patch spreadsheet, a ticket queue or a security agent, and anyone can check why a CVE landed where it did.

How the priority is computed (method v1)

Rules are checked top-down; the first match sets the band.

Band	Rule
critical-now	In CISA KEV, or CISA SSVC says exploitation is active, or EPSS >= 0.5 (configurable)
high	CVSS >= 9.0, or EPSS >= 0.1 (configurable), or CVSS >= 7.0 and EPSS percentile >= 0.90
medium	CVSS >= 4.0, or EPSS >= 0.01
low	Everything else (also rejected CVEs)

Risk score (for sorting inside a band): 4 x CVSS (0-40) + 40 x EPSS (0-40) + 20 if in KEV, capped at 100. Every row carries scoreExplanation, e.g. 4 x CVSS 10.0 = 40.0 + 40 x EPSS 0.9440 = 37.8 + KEV +20 = 20.0 -> 97.8.

CVSS used: v3.1, else v4.0, else v3.0, else v2.0; inside a version, NVD's own (Primary) score wins over the CNA's. Both v3.1 and v4.0 are always returned in their own columns. The same inputs always give the same band and score; methodVersion, sources (with the KEV catalog version) and epssDate are stored in each row.

Output is sorted by band, then risk score.

Input

Field	Description
cveIds	CVE IDs (up to 1,000). When filled, search fields are ignored.
keyword	Search mode: words searched in NVD descriptions (e.g. PAN-OS).
cpe	Search mode: full or partial CPE 2.3 name (e.g. cpe:2.3:a:apache:log4j).
publishedFrom / publishedTo	Search mode: publication window (default: last 30 days). Split automatically into the 120-day windows NVD accepts.
maxResults	Search mode: cap on CVEs (default 200, max 2,000).
minPriority	Only output, and pay for, CVEs at this band or above (default low = all).
epssCriticalThreshold / epssHighThreshold	EPSS cut-offs for critical-now (0.5) and high (0.1), to match your own policy.
nvdApiKey	Optional free NVD API key. Without it NVD allows 5 requests per 30 s (one request per CVE ID, about 6 s each); with it, 50. Search mode needs only one request per 200 CVEs.

The default input (4 CVEs) runs in about 15 seconds.

Output

{
  "cveId": "CVE-2021-44228",
  "priority": "critical-now",
  "riskScore": 97.8,
  "priorityReasons": ["Listed in CISA KEV: exploited in the wild", "KEV: known use in ransomware campaigns",
                      "EPSS 0.944 >= 0.5 (likely exploitation in next 30 days)"],
  "scoreExplanation": "4 x CVSS 10.0 = 40.0 + 40 x EPSS 0.9440 = 37.8 + KEV +20 = 20.0 -> 97.8",
  "cvssScore": 10.0, "cvssVersionUsed": "3.1", "cvssSeverity": "CRITICAL",
  "cvss31Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "cvss40Score": null,
  "epss": 0.94401, "epssPercentile": 0.99993, "epssDate": "2026-10-29",
  "inKev": true, "kevDateAdded": "2021-12-10", "kevDueDate": "2021-12-24", "kevPastDue": true,
  "kevRansomwareUse": "Known",
  "ssvc": {"exploitation": "active", "automatable": "yes", "technicalImpact": "total"},
  "cwes": ["CWE-20", "CWE-400", "CWE-502", "CWE-917"],
  "affectedProducts": ["siemens:6bk1602-0aa12-0tp0_firmware", "...", "apache:log4j", "..."],
  "affectedCpeCount": 358,
  "published": "2021-12-10T10:15:09.143", "nvdStatus": "Analyzed",
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "references": [{"url": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html",
                  "tags": ["Third Party Advisory", "VDB Entry"]}],
  "methodVersion": "1",
  "sources": {"nvd": "NVD API 2.0", "kevCatalogVersion": "2026.10.30", "epss": "FIRST EPSS API",
              "kevUrl": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}
}

Lists are capped to keep rows spreadsheet-friendly: 30 references, 100 CPEs and 50 products (referenceCount and affectedCpeCount give the totals). Invalid IDs and CVEs that NVD does not know come back as rows with an error field and are not charged. The run summary (OUTPUT record) counts CVEs per band.

How much does it cost?

Pay per event, two events:

• apify-actor-start: US$ 0.00005 per run (Apify's recommended start event, charged by the platform).
• cve: charged once per CVE row returned.

Invalid or unknown IDs and CVEs filtered out by minPriority are free. If a source is down, the run fails before any cve event is charged, so you never pay for a priority computed without KEV or EPSS.

Price: US$ 0.003 per CVE (US$ 3 per 1,000). How it was set:

• Apify compute costs US$ 0.20 per compute unit (1 CU = 1 GB of memory for 1 hour). The Actor runs at 256 MB (measured peak: 81 MB for the default input, 193 MB for a 2,000-CVE search).
• Worst case is ID mode without an NVD key: about 6.2 s per CVE because of NVD's rate limit, so 0.25 GB x 6.2 s / 3,600 = 0.00043 CU = US$ 0.00009 per CVE. With a key or in search mode, it is roughly ten times less.
• Each run also pays for start-up plus the KEV download (about 5-10 s, US$ 0.0001-0.0002).
• After Apify's 20% commission, US$ 0.003 leaves US$ 0.0024 per CVE, more than 25 times the worst-case compute cost. Runs by free-plan users earn nothing but still cost compute, which this margin absorbs.

Store comparison (October 2026 listings): NVD-only feeds charge about US$ 1.50 per 1,000; NVD + KEV + EPSS feeds without a priority method about US$ 1.90 per 1,000; EPSS-only Actors about US$ 3 per 1,000; triage Actors US$ 6 to US$ 120 per 1,000. US$ 3 per 1,000 is mid-market for all three sources plus a documented, reproducible priority.

$0.003 per prioritized cve (cve event, pay per event). Charged once per CVE row returned with NVD, CISA KEV and EPSS data and a priority band. Invalid or unknown IDs and CVEs filtered out by minPriority are free.

You get	Free tier	Bronze tier (10% off)	Gold tier (30% off)
100 prioritized cves	$0.30	$0.27	$0.21
1,000 prioritized cves	$3.00	$2.70	$2.10
10,000 prioritized cves	$30.00	$27.00	$21.00

Discounts follow your Apify subscription tier: Bronze 10%, Silver 20%, Gold and above 30%. No subscription to this Actor and no charge for platform usage: you pay only for results. The Apify Free plan includes $5 of monthly credit, enough for about 1,666 prioritized cves at the list price. You can cap the cost of any run with Maximum cost per run; the Actor stops when it is reached.

Data source

• NVD (NIST), CVE API 2.0. US Government data, public domain in the US. This product uses the NVD API but is not endorsed or certified by the NVD.
• CISA Known Exploited Vulnerabilities catalog, downloaded once per run from cisa.gov or its official mirror github.com/cisagov/kev-data. CC0 1.0. Use does not imply endorsement by CISA or DHS.
• EPSS by FIRST, via the EPSS API (batches of 100 CVEs). Free to use; please cite: Jay Jacobs, Sasha Romanosky, Benjamin Edwards, Michael Roytman, Idris Adjerid, Exploit Prediction Scoring System (EPSS), Digital Threats: Research and Practice, 2021. See first.org/epss.
• CISA SSVC decision points come from CISA's Vulnrichment data as published inside NVD records.

On shared cloud IPs the NVD public rate limit can be partly used by other clients; the Actor backs off and retries when NVD answers 403, and a free API key removes the problem. If a source stays unreachable, the run fails with a message naming the host, and nothing is charged.

Not affiliated with NIST, NVD, CISA, DHS or FIRST. This Actor uses their public data as described above; it is not endorsed or certified by any of them.

No personal data is collected. Freshness follows the sources: NVD updates continuously, KEV on weekdays, EPSS once a day. The priority is a triage aid, not a substitute for knowing your own exposure.

More questions

In what format can I paste CVE IDs?

One per line, or several on a line separated by spaces, commas or semicolons, in upper or lower case (cve-2024-3094 works). Duplicates are looked up once. Anything that is not CVE-YYYY-NNNN comes back as a free row with an error field.

How fresh are KEV and EPSS?

Both are read live on every run. The KEV catalog is downloaded from cisa.gov (or CISA's official cisagov/kev-data mirror on GitHub if cisa.gov does not answer), and each row stores the catalog version in sources.kevCatalogVersion. EPSS is published once a day by FIRST; epssDate tells you which day's score you got.

Why does it run slowly without an NVD API key?

Without a key NVD allows 5 requests per 30 seconds, and ID mode needs one request per CVE, so a list takes about 6 seconds per CVE. The Actor keeps to that limit and retries when NVD pushes back. A free NVD key raises the limit to 50 requests per 30 seconds. Search mode is much lighter: one request returns up to 200 CVEs.

Can I combine a keyword and a CPE?

Yes. In search mode both are sent to NVD together, so you get CVEs that match both, published inside the publishedFrom/publishedTo window (last 30 days by default). Long windows are split into the 120-day pieces NVD accepts. Rejected CVEs are left out of searches.

What happens to a CVE that has no CVSS score or no EPSS score yet?

It still gets a row and a band. Missing values count as zero in the risk score, and scoreExplanation says so (for example "no EPSS (0)"). A CVE in KEV is always critical-now, with or without CVSS.

What if NVD, CISA or FIRST is down?

The run stops with a message naming the host, and no cve event is charged. The Actor does not fall back to an old copy of KEV or EPSS, because a stale copy could rank a newly exploited CVE too low.

How do I get only what needs action now?

Set minPriority to critical-now or high. CVEs below that band are not returned and not charged. If your policy is stricter or looser, change epssCriticalThreshold and epssHighThreshold.

Can I give it my SBOM or asset inventory?

Not yet. Give it CVE IDs, or search by keyword or CPE. To cover a product list, run one search per CPE.

Use it via API

Run it from any language and get the results as JSON. Replace <YOUR_API_TOKEN> with your Apify API token.

curl -X POST "https://api.apify.com/v2/acts/br_data_hub~cve-risk-prioritizer/run-sync-get-dataset-items?token=<YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"cveIds": ["CVE-2021-44228", "CVE-2025-0108", "CVE-2023-48795", "CVE-2024-3094"]}'

from apify_client import ApifyClient

client = ApifyClient("<YOUR_API_TOKEN>")
run = client.actor("br_data_hub/cve-risk-prioritizer").call(run_input={'cveIds': ['CVE-2021-44228', 'CVE-2025-0108', 'CVE-2023-48795', 'CVE-2024-3094']})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

You can also schedule runs, send results to webhooks, or connect the Actor to Make, Zapier, n8n, Google Sheets and other integrations.

Use it with AI agents (MCP)

This Actor is ready for AI agents: typed input and output schemas, pay-per-event pricing, limited permissions and short runs.

• Apify MCP server: add https://mcp.apify.com/?tools=br_data_hub/cve-risk-prioritizer to Claude, ChatGPT, Cursor, VS Code or any MCP client, and the agent can call this Actor as a tool.
• Agent frameworks: call it from LangChain, LlamaIndex, CrewAI or the OpenAI Agents SDK through the Apify integrations, or with the API call above.
• Results come as structured JSON with stable field names, documented in the Output tab.

FAQ

Where does the data come from?

• NVD (NIST), CVE API 2.0. US Government data, public domain in the US. This product uses the NVD API but is not endorsed or certified by the NVD. - CISA Known Exploited Vulnerabilities catalog, downloaded once per run from cisa.gov or its official mirror github.com/cisagov/kev-data. CC0 1.0. Use does not imply endorsement by CISA or DHS. - EPSS by FIRST, via the EPSS API (batches of 100 CVEs). Free to use; please cite: Jay Jacobs, Sasha Romanosky, Benjamin Edwards, Michael Roytman, Idris Adjerid, Exploit Prediction Scoring System (EPSS), Digital Threats: Research and Practice, 2021. See first.org/epss. - CISA SSVC decision points come from CISA's Vulnrichment data as published inside NVD records.

How much does it cost?

$0.003 per prioritized cve. Discounts follow your Apify subscription tier: Bronze 10%, Silver 20%, Gold and above 30%. See How much does it cost? above for examples.

Do I pay for errors or empty results?

No. Charged once per CVE row returned with NVD, CISA KEV and EPSS data and a priority band. Invalid or unknown IDs and CVEs filtered out by minPriority are free.

Can I run it on a schedule or connect it to other tools?

Yes. Use Apify schedules to run it daily or weekly, webhooks to get notified, and integrations such as Make, Zapier, n8n and Google Sheets. Everything also works through the API.

Can AI agents use it?

Yes. It works as a tool in the Apify MCP server and in agent frameworks, and AI agents can pay per event. See Use it with AI agents (MCP).

Is it legal to use this data?

The Actor reads only public sources. You are responsible for how you use the data and for complying with the source's terms and with privacy laws such as GDPR.

I found a bug or need a feature. What should I do?

Open an issue in the Issues tab. We answer within 14 days, usually much sooner.

More Actors from BR Data Hub

Actor	What it does
Domain RDAP Lookup: modern WHOIS for any TLD	Bulk RDAP lookup on each TLD's official registry server (IANA bootstrap): registrar, creation, update and expi
Email Domain Auth Checker: SPF, DKIM, DMARC, BIMI, MTA-STS	Bulk check SPF (real recursive lookup count vs
Food, Drug & Device Recalls Monitor (from openFDA data)	Food, drug and medical device recalls from the official openFDA enforcement API in one uniform format
Clinical Trials Tracker, from ClinicalTrials.gov data	Search public ClinicalTrials.gov data by condition, drug, sponsor, phase, status and country, and track what c

See all our Actors at apify.com/br_data_hub.

Usar em português

Informe IDs de CVE, ou uma palavra-chave ou CPE de produto com janela de datas, e receba uma linha por CVE que junta NVD (CVSS v3.1/v4, CWE, produtos afetados), catálogo CISA KEV (explorada ativamente, prazo federal, uso em ransomware) e EPSS da FIRST (probabilidade de exploração). Cada linha traz a faixa de prioridade (critical-now, high, medium, low), uma nota de 0 a 100 e a explicação de como foi calculada. Cobrança por CVE retornada; IDs inválidos ou não encontrados não são cobrados. A chave gratuita da NVD (nvdApiKey) deixa listas grandes dez vezes mais rápidas.

Quanto custa: $0.003 por resultado (cve); 1.000 resultados saem por $3.00. Desconto pelo nível da assinatura Apify: Bronze 10%, Silver 20%, Gold ou acima 30%. Erros e consultas sem resultado não são cobrados. Use também pela API ou por agentes de IA no servidor MCP da Apify (https://mcp.apify.com/?tools=br_data_hub/cve-risk-prioritizer).