# CVE Risk Prioritizer, from NVD, CISA KEV and EPSS data (`br_data_hub/cve-risk-prioritizer`) Actor One row per CVE built from public NVD (CVSS, CWE, affected products), CISA KEV (exploited, due date, ransomware) and FIRST EPSS data, with an explainable patch priority. - **URL**: https://apify.com/br_data_hub/cve-risk-prioritizer.md - **Developed by:** [br_data_hub](https://apify.com/br_data_hub) (community) - **Categories:** Developer tools, AI, Business - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $2.10 / 1,000 prioritized cves This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event ## What's an Apify Actor? An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md. ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run. For examples already wired to this Actor's own input schema, see the [API](#api) section below. Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`). # README ## CVE Risk Prioritizer, from NVD, CISA KEV and EPSS data Give it **CVE IDs**, or a **keyword / product CPE with a date window**, and get **one row per CVE** that joins the three official sources security teams check by hand: - **NVD API 2.0**: CVSS v3.1 and v4.0 (score, severity, vector), CWE, affected products (CPE), references, NVD status - **CISA KEV catalog**: exploited in the wild, date added, federal due date (and whether it is past), known ransomware use, required action - **FIRST EPSS**: probability of exploitation in the next 30 days and its percentile Each row gets a **priority band** (`critical-now`, `high`, `medium`, `low`), a **0-100 risk score** and the **plain-English reasons and formula** behind them, so the result can go straight into a patch spreadsheet, a ticket queue or a security agent, and anyone can check why a CVE landed where it did. ### How the priority is computed (method v1) Rules are checked top-down; the first match sets the band. | Band | Rule | |---|---| | `critical-now` | In CISA KEV, **or** CISA SSVC says exploitation is `active`, **or** EPSS >= 0.5 (configurable) | | `high` | CVSS >= 9.0, **or** EPSS >= 0.1 (configurable), **or** CVSS >= 7.0 and EPSS percentile >= 0.90 | | `medium` | CVSS >= 4.0, **or** EPSS >= 0.01 | | `low` | Everything else (also rejected CVEs) | **Risk score** (for sorting inside a band): `4 x CVSS (0-40) + 40 x EPSS (0-40) + 20 if in KEV`, capped at 100. Every row carries `scoreExplanation`, e.g. `4 x CVSS 10.0 = 40.0 + 40 x EPSS 0.9440 = 37.8 + KEV +20 = 20.0 -> 97.8`. **CVSS used**: v3.1, else v4.0, else v3.0, else v2.0; inside a version, NVD's own (Primary) score wins over the CNA's. Both v3.1 and v4.0 are always returned in their own columns. The same inputs always give the same band and score; `methodVersion`, `sources` (with the KEV catalog version) and `epssDate` are stored in each row. Output is sorted by band, then risk score. ### Input | Field | Description | |---|---| | `cveIds` | CVE IDs (up to 1,000). When filled, search fields are ignored. | | `keyword` | Search mode: words searched in NVD descriptions (e.g. `PAN-OS`). | | `cpe` | Search mode: full or partial CPE 2.3 name (e.g. `cpe:2.3:a:apache:log4j`). | | `publishedFrom` / `publishedTo` | Search mode: publication window (default: last 30 days). Split automatically into the 120-day windows NVD accepts. | | `maxResults` | Search mode: cap on CVEs (default 200, max 2,000). | | `minPriority` | Only output, and pay for, CVEs at this band or above (default `low` = all). | | `epssCriticalThreshold` / `epssHighThreshold` | EPSS cut-offs for `critical-now` (0.5) and `high` (0.1), to match your own policy. | | `nvdApiKey` | Optional free [NVD API key](https://nvd.nist.gov/developers/request-an-api-key). Without it NVD allows 5 requests per 30 s (one request per CVE ID, about 6 s each); with it, 50. Search mode needs only one request per 200 CVEs. | The default input (4 CVEs) runs in about 15 seconds. ### Output ```json { "cveId": "CVE-2021-44228", "priority": "critical-now", "riskScore": 97.8, "priorityReasons": ["Listed in CISA KEV: exploited in the wild", "KEV: known use in ransomware campaigns", "EPSS 0.944 >= 0.5 (likely exploitation in next 30 days)"], "scoreExplanation": "4 x CVSS 10.0 = 40.0 + 40 x EPSS 0.9440 = 37.8 + KEV +20 = 20.0 -> 97.8", "cvssScore": 10.0, "cvssVersionUsed": "3.1", "cvssSeverity": "CRITICAL", "cvss31Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "cvss40Score": null, "epss": 0.94401, "epssPercentile": 0.99993, "epssDate": "2026-10-29", "inKev": true, "kevDateAdded": "2021-12-10", "kevDueDate": "2021-12-24", "kevPastDue": true, "kevRansomwareUse": "Known", "ssvc": {"exploitation": "active", "automatable": "yes", "technicalImpact": "total"}, "cwes": ["CWE-20", "CWE-400", "CWE-502", "CWE-917"], "affectedProducts": ["siemens:6bk1602-0aa12-0tp0_firmware", "...", "apache:log4j", "..."], "affectedCpeCount": 358, "published": "2021-12-10T10:15:09.143", "nvdStatus": "Analyzed", "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228", "references": [{"url": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html", "tags": ["Third Party Advisory", "VDB Entry"]}], "methodVersion": "1", "sources": {"nvd": "NVD API 2.0", "kevCatalogVersion": "2026.10.30", "epss": "FIRST EPSS API", "kevUrl": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"} } ``` Lists are capped to keep rows spreadsheet-friendly: 30 references, 100 CPEs and 50 products (`referenceCount` and `affectedCpeCount` give the totals). Invalid IDs and CVEs that NVD does not know come back as rows with an `error` field and are **not charged**. The run summary (`OUTPUT` record) counts CVEs per band. ### How much does it cost? Pay per event, two events: - **`apify-actor-start`**: US$ 0.00005 per run (Apify's recommended start event, charged by the platform). - **`cve`**: charged once per CVE row returned. Invalid or unknown IDs and CVEs filtered out by `minPriority` are free. If a source is down, the run fails before any `cve` event is charged, so you never pay for a priority computed without KEV or EPSS. Price: **US$ 0.003 per CVE (US$ 3 per 1,000)**. How it was set: - Apify compute costs US$ 0.20 per compute unit (1 CU = 1 GB of memory for 1 hour). The Actor runs at 256 MB (measured peak: 81 MB for the default input, 193 MB for a 2,000-CVE search). - Worst case is ID mode without an NVD key: about 6.2 s per CVE because of NVD's rate limit, so 0.25 GB x 6.2 s / 3,600 = 0.00043 CU = **US$ 0.00009 per CVE**. With a key or in search mode, it is roughly ten times less. - Each run also pays for start-up plus the KEV download (about 5-10 s, US$ 0.0001-0.0002). - After Apify's 20% commission, US$ 0.003 leaves US$ 0.0024 per CVE, more than 25 times the worst-case compute cost. Runs by free-plan users earn nothing but still cost compute, which this margin absorbs. Store comparison (October 2026 listings): NVD-only feeds charge about US$ 1.50 per 1,000; NVD + KEV + EPSS feeds without a priority method about US$ 1.90 per 1,000; EPSS-only Actors about US$ 3 per 1,000; triage Actors US$ 6 to US$ 120 per 1,000. US$ 3 per 1,000 is mid-market for all three sources plus a documented, reproducible priority. **$0.003 per prioritized cve** (`cve` event, pay per event). Charged once per CVE row returned with NVD, CISA KEV and EPSS data and a priority band. Invalid or unknown IDs and CVEs filtered out by minPriority are free. | You get | Free tier | Bronze tier (10% off) | Gold tier (30% off) | |---|---|---|---| | 100 prioritized cves | $0.30 | $0.27 | $0.21 | | 1,000 prioritized cves | $3.00 | $2.70 | $2.10 | | 10,000 prioritized cves | $30.00 | $27.00 | $21.00 | Discounts follow your Apify subscription tier: Bronze 10%, Silver 20%, Gold and above 30%. No subscription to this Actor and no charge for platform usage: you pay only for results. The Apify Free plan includes $5 of monthly credit, enough for about **1,666 prioritized cves** at the list price. You can cap the cost of any run with **Maximum cost per run**; the Actor stops when it is reached. ### Data source - **NVD** (NIST), [CVE API 2.0](https://nvd.nist.gov/developers/vulnerabilities). US Government data, public domain in the US. *This product uses the NVD API but is not endorsed or certified by the NVD.* - **CISA Known Exploited Vulnerabilities catalog**, downloaded once per run from [cisa.gov](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) or its official mirror [github.com/cisagov/kev-data](https://github.com/cisagov/kev-data). CC0 1.0. Use does not imply endorsement by CISA or DHS. - **EPSS** by [FIRST](https://www.first.org/epss), via the [EPSS API](https://api.first.org/data/v1/epss) (batches of 100 CVEs). Free to use; please cite: Jay Jacobs, Sasha Romanosky, Benjamin Edwards, Michael Roytman, Idris Adjerid, *Exploit Prediction Scoring System (EPSS)*, Digital Threats: Research and Practice, 2021. See [first.org/epss](https://www.first.org/epss). - CISA SSVC decision points come from CISA's Vulnrichment data as published inside NVD records. On shared cloud IPs the NVD public rate limit can be partly used by other clients; the Actor backs off and retries when NVD answers 403, and a free API key removes the problem. If a source stays unreachable, the run fails with a message naming the host, and nothing is charged. **Not affiliated with NIST, NVD, CISA, DHS or FIRST.** This Actor uses their public data as described above; it is not endorsed or certified by any of them. No personal data is collected. Freshness follows the sources: NVD updates continuously, KEV on weekdays, EPSS once a day. The priority is a triage aid, not a substitute for knowing your own exposure. ### More questions #### In what format can I paste CVE IDs? One per line, or several on a line separated by spaces, commas or semicolons, in upper or lower case (`cve-2024-3094` works). Duplicates are looked up once. Anything that is not `CVE-YYYY-NNNN` comes back as a free row with an `error` field. #### How fresh are KEV and EPSS? Both are read live on every run. The KEV catalog is downloaded from cisa.gov (or CISA's official `cisagov/kev-data` mirror on GitHub if cisa.gov does not answer), and each row stores the catalog version in `sources.kevCatalogVersion`. EPSS is published once a day by FIRST; `epssDate` tells you which day's score you got. #### Why does it run slowly without an NVD API key? Without a key NVD allows 5 requests per 30 seconds, and ID mode needs one request per CVE, so a list takes about 6 seconds per CVE. The Actor keeps to that limit and retries when NVD pushes back. A free NVD key raises the limit to 50 requests per 30 seconds. Search mode is much lighter: one request returns up to 200 CVEs. #### Can I combine a keyword and a CPE? Yes. In search mode both are sent to NVD together, so you get CVEs that match both, published inside the `publishedFrom`/`publishedTo` window (last 30 days by default). Long windows are split into the 120-day pieces NVD accepts. Rejected CVEs are left out of searches. #### What happens to a CVE that has no CVSS score or no EPSS score yet? It still gets a row and a band. Missing values count as zero in the risk score, and `scoreExplanation` says so (for example "no EPSS (0)"). A CVE in KEV is always `critical-now`, with or without CVSS. #### What if NVD, CISA or FIRST is down? The run stops with a message naming the host, and no `cve` event is charged. The Actor does not fall back to an old copy of KEV or EPSS, because a stale copy could rank a newly exploited CVE too low. #### How do I get only what needs action now? Set `minPriority` to `critical-now` or `high`. CVEs below that band are not returned and not charged. If your policy is stricter or looser, change `epssCriticalThreshold` and `epssHighThreshold`. #### Can I give it my SBOM or asset inventory? Not yet. Give it CVE IDs, or search by keyword or CPE. To cover a product list, run one search per CPE. ### Use it via API Run it from any language and get the results as JSON. Replace `` with your [Apify API token](https://console.apify.com/settings/integrations). ```bash curl -X POST "https://api.apify.com/v2/acts/br_data_hub~cve-risk-prioritizer/run-sync-get-dataset-items?token=" \ -H "Content-Type: application/json" \ -d '{"cveIds": ["CVE-2021-44228", "CVE-2025-0108", "CVE-2023-48795", "CVE-2024-3094"]}' ``` ```python from apify_client import ApifyClient client = ApifyClient("") run = client.actor("br_data_hub/cve-risk-prioritizer").call(run_input={'cveIds': ['CVE-2021-44228', 'CVE-2025-0108', 'CVE-2023-48795', 'CVE-2024-3094']}) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) ``` You can also schedule runs, send results to webhooks, or connect the Actor to Make, Zapier, n8n, Google Sheets and other [integrations](https://docs.apify.com/platform/integrations). ### Use it with AI agents (MCP) This Actor is ready for AI agents: typed input and output schemas, pay-per-event pricing, limited permissions and short runs. - **Apify MCP server:** add `https://mcp.apify.com/?tools=br_data_hub/cve-risk-prioritizer` to Claude, ChatGPT, Cursor, VS Code or any MCP client, and the agent can call this Actor as a tool. - **Agent frameworks:** call it from LangChain, LlamaIndex, CrewAI or the OpenAI Agents SDK through the Apify integrations, or with the API call above. - Results come as structured JSON with stable field names, documented in the **Output** tab. ### FAQ #### Where does the data come from? - **NVD** (NIST), [CVE API 2.0](https://nvd.nist.gov/developers/vulnerabilities). US Government data, public domain in the US. *This product uses the NVD API but is not endorsed or certified by the NVD.* - **CISA Known Exploited Vulnerabilities catalog**, downloaded once per run from [cisa.gov](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) or its official mirror [github.com/cisagov/kev-data](https://github.com/cisagov/kev-data). CC0 1.0. Use does not imply endorsement by CISA or DHS. - **EPSS** by [FIRST](https://www.first.org/epss), via the [EPSS API](https://api.first.org/data/v1/epss) (batches of 100 CVEs). Free to use; please cite: Jay Jacobs, Sasha Romanosky, Benjamin Edwards, Michael Roytman, Idris Adjerid, *Exploit Prediction Scoring System (EPSS)*, Digital Threats: Research and Practice, 2021. See [first.org/epss](https://www.first.org/epss). - CISA SSVC decision points come from CISA's Vulnrichment data as published inside NVD records. #### How much does it cost? $0.003 per prioritized cve. Discounts follow your Apify subscription tier: Bronze 10%, Silver 20%, Gold and above 30%. See **How much does it cost?** above for examples. #### Do I pay for errors or empty results? No. Charged once per CVE row returned with NVD, CISA KEV and EPSS data and a priority band. Invalid or unknown IDs and CVEs filtered out by minPriority are free. #### Can I run it on a schedule or connect it to other tools? Yes. Use Apify schedules to run it daily or weekly, webhooks to get notified, and integrations such as Make, Zapier, n8n and Google Sheets. Everything also works through the API. #### Can AI agents use it? Yes. It works as a tool in the Apify MCP server and in agent frameworks, and AI agents can pay per event. See **Use it with AI agents (MCP)**. #### Is it legal to use this data? The Actor reads only public sources. You are responsible for how you use the data and for complying with the source's terms and with privacy laws such as GDPR. #### I found a bug or need a feature. What should I do? Open an issue in the **Issues** tab. We answer within 14 days, usually much sooner. ### More Actors from BR Data Hub | Actor | What it does | |---|---| | [Domain RDAP Lookup: modern WHOIS for any TLD](https://apify.com/br_data_hub/domain-rdap-lookup) | Bulk RDAP lookup on each TLD's official registry server (IANA bootstrap): registrar, creation, update and expi | | [Email Domain Auth Checker: SPF, DKIM, DMARC, BIMI, MTA-STS](https://apify.com/br_data_hub/email-domain-auth-checker) | Bulk check SPF (real recursive lookup count vs | | [Food, Drug & Device Recalls Monitor (from openFDA data)](https://apify.com/br_data_hub/fda-recalls-monitor) | Food, drug and medical device recalls from the official openFDA enforcement API in one uniform format | | [Clinical Trials Tracker, from ClinicalTrials.gov data](https://apify.com/br_data_hub/clinical-trials-tracker) | Search public ClinicalTrials.gov data by condition, drug, sponsor, phase, status and country, and track what c | See all our Actors at [apify.com/br_data_hub](https://apify.com/br_data_hub). ### Usar em português Informe IDs de CVE, ou uma palavra-chave ou CPE de produto com janela de datas, e receba uma linha por CVE que junta NVD (CVSS v3.1/v4, CWE, produtos afetados), catálogo CISA KEV (explorada ativamente, prazo federal, uso em ransomware) e EPSS da FIRST (probabilidade de exploração). Cada linha traz a faixa de prioridade (`critical-now`, `high`, `medium`, `low`), uma nota de 0 a 100 e a explicação de como foi calculada. Cobrança por CVE retornada; IDs inválidos ou não encontrados não são cobrados. A chave gratuita da NVD (`nvdApiKey`) deixa listas grandes dez vezes mais rápidas. **Quanto custa:** $0.003 por resultado (`cve`); 1.000 resultados saem por $3.00. Desconto pelo nível da assinatura Apify: Bronze 10%, Silver 20%, Gold ou acima 30%. Erros e consultas sem resultado não são cobrados. Use também pela API ou por agentes de IA no servidor MCP da Apify (`https://mcp.apify.com/?tools=br_data_hub/cve-risk-prioritizer`). # Actor input Schema ## `cveIds` (type: `array`): Enter CVE IDs to enrich and prioritize, one per line, e.g. CVE-2021-44228 (up to 1,000 per run). Without an NVD API key, 100 CVEs take about 10 minutes. When this list is filled, the search section below is ignored. ## `keyword` (type: `string`): Type words to search in NVD CVE descriptions, e.g. PAN-OS or Fortinet FortiOS. Combine with the publication dates below. ## `cpe` (type: `string`): Type a full or partial CPE 2.3 product name, e.g. cpe:2.3:a:apache:log4j. Sent to the NVD as virtualMatchString. ## `publishedFrom` (type: `string`): Pick the oldest CVE publication date. Leave empty for 30 days before 'Published to'. Long ranges are split into the 120-day windows the NVD accepts. ## `publishedTo` (type: `string`): Pick the newest CVE publication date. Leave empty for today. ## `maxResults` (type: `integer`): Set how many CVEs to take from the search, newest first, e.g. 200. Up to 2,000 per run at the default 256 MB; split longer periods into several runs. ## `minPriority` (type: `string`): Pick the lowest priority to return (and pay for), e.g. high and above. Keep 'all (low and above)' to return everything. ## `epssCriticalThreshold` (type: `number`): Set the EPSS probability (0 to 1) at or above which a CVE is critical-now even if it is not in KEV, e.g. 0.5. ## `epssHighThreshold` (type: `number`): Set the EPSS probability (0 to 1) at or above which a CVE is at least high, e.g. 0.1. ## `nvdApiKey` (type: `string`): Paste a free key from nvd.nist.gov/developers/request-an-api-key to raise the NVD limit from 5 to 50 requests per 30 seconds, so large CVE lists run 10 times faster. Optional. ## Actor input object example ```json { "cveIds": [ "CVE-2021-44228", "CVE-2025-0108", "CVE-2023-48795", "CVE-2024-3094" ], "maxResults": 200, "minPriority": "low", "epssCriticalThreshold": 0.5, "epssHighThreshold": 0.1 } ``` # Actor output Schema ## `dataset` (type: `string`): Dataset with all results # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "cveIds": [ "CVE-2021-44228", "CVE-2025-0108", "CVE-2023-48795", "CVE-2024-3094" ] }; // Run the Actor and wait for it to finish const run = await client.actor("br_data_hub/cve-risk-prioritizer").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "cveIds": [ "CVE-2021-44228", "CVE-2025-0108", "CVE-2023-48795", "CVE-2024-3094", ] } # Run the Actor and wait for it to finish run = client.actor("br_data_hub/cve-risk-prioritizer").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "cveIds": [ "CVE-2021-44228", "CVE-2025-0108", "CVE-2023-48795", "CVE-2024-3094" ] }' | apify call br_data_hub/cve-risk-prioritizer --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,br_data_hub/cve-risk-prioritizer" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/C4sOjWVAUVWaWeeFA/builds/Gh2Mvb9FjPjIy8GrR/openapi.json