# NVD CVE Search & CISA KEV Vulnerability Intelligence (`captainhandsome/nvd-cisa-vulnerability-intelligence`) Actor

Search NIST NVD CVEs and enrich them with CISA Known Exploited Vulnerability status, CVSS, CWE, CPE, ransomware use, remediation actions, and due dates.

- **URL**: https://apify.com/captainhandsome/nvd-cisa-vulnerability-intelligence.md
- **Developed by:** [Joseph McRell](https://apify.com/captainhandsome) (community)
- **Categories:** Developer tools, Other
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.40 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## NVD CVE Search & CISA KEV Vulnerability Intelligence API

Search the official NIST National Vulnerability Database and enrich every CVE with CISA Known Exploited Vulnerabilities intelligence. Export normalized descriptions, CVSS severity, CWE weaknesses, affected CPEs, references, exploitation status, ransomware use, remediation actions, and due dates.

No API key, login, browser automation, or paid proxy is required.

### What data can I extract?

- CVE ID, description, source, publication date, and modification date
- CVSS version, score, severity, and vector
- CWE weakness identifiers, bounded affected-CPE and reference lists, plus full source counts
- CISA KEV membership, vendor, product, and vulnerability name
- Required remediation action and federal due date
- Known ransomware-campaign use and CISA notes
- Reproducible official NVD and CISA source URLs

Each row represents one NVD CVE, optionally filtered to entries in CISA's KEV catalog.

### Input example

```json
{
  "query": "Microsoft Exchange",
  "severity": "CRITICAL",
  "kev_only": true,
  "max_references": 50,
  "max_cpes": 100,
  "max_items": 25
}
```

For an exact lookup, supply `cve_id`; it overrides `query`. Publication date filters must be supplied as a pair using NVD timestamps.

### Output example

```json
{
  "cve_id": "CVE-2021-44228",
  "description": "Apache Log4j2 JNDI features do not protect against attacker-controlled endpoints.",
  "source_identifier": "security@apache.org",
  "published_at": "2021-12-10T10:15:09.143",
  "last_modified_at": "2025-10-21T18:51:31.373",
  "vulnerability_status": "Modified",
  "cvss_version": "3.1",
  "cvss_score": 10.0,
  "cvss_severity": "CRITICAL",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "cwe_ids": ["CWE-20", "CWE-400", "CWE-502"],
  "reference_count": 52,
  "references_truncated": true,
  "affected_cpe_count": 286,
  "affected_cpes_truncated": true,
  "is_known_exploited": true,
  "kev_vendor_project": "Apache",
  "kev_product": "Log4j2",
  "kev_required_action": "Apply updates per vendor instructions.",
  "kev_due_date": "2021-12-24",
  "kev_known_ransomware_campaign_use": "Known"
}
```

### Common use cases

- Vulnerability triage and asset exposure research
- Prioritizing actively exploited CVEs over raw severity alone
- Security advisories, ticket enrichment, and patch workflows
- Threat-intelligence feeds and recurring vulnerability monitoring
- Supplying current structured evidence to AI security agents

### Use with AI agents and MCP

The flat schema lets an agent search by vendor, product, or exact CVE and immediately distinguish theoretical vulnerabilities from those CISA confirms are exploited. Agents can prioritize remediation by KEV due date, CVSS, ransomware use, CWE, or affected platform without joining two government feeds themselves.

### Pricing and cost control

Output is billed per result at **$0.002 per result** (about $2.00 per 1,000 results), plus a $0.0005 Actor-start charge billed once per gigabyte of memory at run start. Use `max_items`, an exact CVE ID, `kev_only`, `max_references`, and `max_cpes` to cap output volume and charges. The price shown on the Apify Store listing is authoritative.

### Reliability

The Actor calls NIST and CISA directly, retries temporary transport, rate-limit, and service failures, validates both response shapes, honors NVD pagination, and never emits more rows than requested. Persistent upstream failures fail visibly rather than producing false empty results.

### Limitations and responsible use

- NIST and CISA determine source coverage, scoring, corrections, and update timing.
- NVD requests without an API key are rate limited, so large filtered jobs may run more slowly.
- Reference and CPE arrays are bounded per record; count and truncation fields disclose omitted values.
- `kev_only` means confirmed inclusion in CISA's catalog, not that other CVEs are unexploited.
- A CPE match is not proof that a particular deployed asset is vulnerable.
- Validate remediation decisions against vendor advisories and your own asset inventory.

### Turn this into a vulnerability monitor

1. Save a Task for each important vendor, product, severity range, or KEV-only watchlist.
2. Schedule it daily and keep `max_items`, `max_references`, and `max_cpes` bounded.
3. Add an `ACTOR.RUN.SUCCEEDED` Task webhook or integration and pass `resource.defaultDatasetId` into ticketing, alerting, or asset-correlation workflows.

Related fleet tools: [Website Tech Stack Detector](https://apify.com/captainhandsome/tech-stack-detector) identifies public web technologies to investigate, while [Google News Search](https://apify.com/captainhandsome/google-news-search) tracks vendor advisories and incident coverage.

### FAQ

#### Why combine NVD and CISA KEV?

NVD supplies broad CVE detail; CISA KEV identifies vulnerabilities with evidence of active exploitation and adds operational remediation fields.

#### Can I look up one CVE?

Yes. Supply `cve_id`, for example `CVE-2021-44228`.

#### What does known exploited only do?

It removes NVD results that are not present in CISA's current KEV catalog.

#### Does the Actor scan my systems?

No. It searches and joins public vulnerability intelligence. It does not inspect networks, software inventories, or devices.

# Changelog

This Actor's version history is a separate document: https://apify.com/captainhandsome/nvd-cisa-vulnerability-intelligence/changelog.md

# Actor input Schema

## `query` (type: `string`):

Keyword, vendor, product, or phrase to search in NVD descriptions.

## `cve_id` (type: `string`):

Optional exact identifier such as CVE-2021-44228. When supplied, it overrides the keyword query.

## `severity` (type: `string`):

Optional NVD CVSS v3 severity filter.

## `published_start` (type: `string`):

Optional NVD timestamp such as 2026-09-01T00:00:00.000. Supply both date fields together.

## `published_end` (type: `string`):

Optional NVD timestamp such as 2026-09-14T23:59:59.999. Supply both date fields together.

## `kev_only` (type: `boolean`):

Return only CVEs that also appear in CISA's Known Exploited Vulnerabilities catalog.

## `max_references` (type: `integer`):

Maximum unique advisory and analysis URLs retained in each vulnerability record.

## `max_cpes` (type: `integer`):

Maximum unique affected CPE criteria retained in each vulnerability record.

## `max_items` (type: `integer`):

Hard limit on vulnerability records saved to the dataset.

## Actor input object example

```json
{
  "query": "Microsoft Exchange",
  "kev_only": false,
  "max_references": 50,
  "max_cpes": 100,
  "max_items": 25
}
```

# Actor output Schema

## `results` (type: `string`):

One flat row per NVD CVE with CISA KEV enrichment.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "query": "Microsoft Exchange"
};

// Run the Actor and wait for it to finish
const run = await client.actor("captainhandsome/nvd-cisa-vulnerability-intelligence").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "query": "Microsoft Exchange" }

# Run the Actor and wait for it to finish
run = client.actor("captainhandsome/nvd-cisa-vulnerability-intelligence").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "query": "Microsoft Exchange"
}' |
apify call captainhandsome/nvd-cisa-vulnerability-intelligence --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,captainhandsome/nvd-cisa-vulnerability-intelligence"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/cnRGR2eslfedLRAyX/builds/VrSVrdmPjyLYK1zq1/openapi.json