NVD CVE Search & CISA KEV Vulnerability Intelligence API

Search the official NIST National Vulnerability Database and enrich every CVE with CISA Known Exploited Vulnerabilities intelligence. Export normalized descriptions, CVSS severity, CWE weaknesses, affected CPEs, references, exploitation status, ransomware use, remediation actions, and due dates.

No API key, login, browser automation, or paid proxy is required.

What data can I extract?

• CVE ID, description, source, publication date, and modification date
• CVSS version, score, severity, and vector
• CWE weakness identifiers, bounded affected-CPE and reference lists, plus full source counts
• CISA KEV membership, vendor, product, and vulnerability name
• Required remediation action and federal due date
• Known ransomware-campaign use and CISA notes
• Reproducible official NVD and CISA source URLs

Each row represents one NVD CVE, optionally filtered to entries in CISA's KEV catalog.

Input example

{
  "query": "Microsoft Exchange",
  "severity": "CRITICAL",
  "kev_only": true,
  "max_references": 50,
  "max_cpes": 100,
  "max_items": 25
}

For an exact lookup, supply cve_id; it overrides query. Publication date filters must be supplied as a pair using NVD timestamps.

Output example

{
  "cve_id": "CVE-2021-44228",
  "description": "Apache Log4j2 JNDI features do not protect against attacker-controlled endpoints.",
  "source_identifier": "security@apache.org",
  "published_at": "2021-12-10T10:15:09.143",
  "last_modified_at": "2025-10-21T18:51:31.373",
  "vulnerability_status": "Modified",
  "cvss_version": "3.1",
  "cvss_score": 10.0,
  "cvss_severity": "CRITICAL",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "cwe_ids": ["CWE-20", "CWE-400", "CWE-502"],
  "reference_count": 52,
  "references_truncated": true,
  "affected_cpe_count": 286,
  "affected_cpes_truncated": true,
  "is_known_exploited": true,
  "kev_vendor_project": "Apache",
  "kev_product": "Log4j2",
  "kev_required_action": "Apply updates per vendor instructions.",
  "kev_due_date": "2021-12-24",
  "kev_known_ransomware_campaign_use": "Known"
}

Common use cases

• Vulnerability triage and asset exposure research
• Prioritizing actively exploited CVEs over raw severity alone
• Security advisories, ticket enrichment, and patch workflows
• Threat-intelligence feeds and recurring vulnerability monitoring
• Supplying current structured evidence to AI security agents

Use with AI agents and MCP

The flat schema lets an agent search by vendor, product, or exact CVE and immediately distinguish theoretical vulnerabilities from those CISA confirms are exploited. Agents can prioritize remediation by KEV due date, CVSS, ransomware use, CWE, or affected platform without joining two government feeds themselves.

Pricing and cost control

Output is billed per result at $0.002 per result (about $2.00 per 1,000 results), plus a $0.0005 Actor-start charge billed once per gigabyte of memory at run start. Use max_items, an exact CVE ID, kev_only, max_references, and max_cpes to cap output volume and charges. The price shown on the Apify Store listing is authoritative.

Reliability

The Actor calls NIST and CISA directly, retries temporary transport, rate-limit, and service failures, validates both response shapes, honors NVD pagination, and never emits more rows than requested. Persistent upstream failures fail visibly rather than producing false empty results.

Limitations and responsible use

• NIST and CISA determine source coverage, scoring, corrections, and update timing.
• NVD requests without an API key are rate limited, so large filtered jobs may run more slowly.
• Reference and CPE arrays are bounded per record; count and truncation fields disclose omitted values.
• kev_only means confirmed inclusion in CISA's catalog, not that other CVEs are unexploited.
• A CPE match is not proof that a particular deployed asset is vulnerable.
• Validate remediation decisions against vendor advisories and your own asset inventory.

Turn this into a vulnerability monitor

1. Save a Task for each important vendor, product, severity range, or KEV-only watchlist.
2. Schedule it daily and keep max_items, max_references, and max_cpes bounded.
3. Add an ACTOR.RUN.SUCCEEDED Task webhook or integration and pass resource.defaultDatasetId into ticketing, alerting, or asset-correlation workflows.

Related fleet tools: Website Tech Stack Detector identifies public web technologies to investigate, while Google News Search tracks vendor advisories and incident coverage.

FAQ

Why combine NVD and CISA KEV?

NVD supplies broad CVE detail; CISA KEV identifies vulnerabilities with evidence of active exploitation and adds operational remediation fields.

Can I look up one CVE?

Yes. Supply cve_id, for example CVE-2021-44228.

What does known exploited only do?

It removes NVD results that are not present in CISA's current KEV catalog.

Does the Actor scan my systems?

No. It searches and joins public vulnerability intelligence. It does not inspect networks, software inventories, or devices.