Vulnerability Intel — CVE, OSV, NVD & KEV Tracker

Pure-HTTP vulnerability intelligence from free official sources. No browser, no proxies, zero anti-bot blocks, no API key required.

What it does

Mode	Description
packageScan	Scan package versions against OSV.dev (Google-backed distributed vulnerability database). One row per known vulnerability. Omit version to list every known vulnerability for a package.
cveDetails	Full CVE records from the NIST NVD: English description, CVSS v3.1 / v3.0 / v2 scores, severity, CWE weaknesses, references.
kevCheck	Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — vulnerabilities with confirmed in-the-wild exploitation, including known ransomware use.
recentCves	Monitor newly published CVEs via NVD (pubStartDate look-back). Results are deduplicated against a persistent store, so each run returns only the CVEs you have not seen yet. First run marks everything baseline: true.
vulnDetails	Fetch full OSV advisory records by ID (GHSA-*, OSV-*, CVE-*).

GitHub Advisory data needs no separate mode: OSV records carry GHSA-* IDs in their aliases field.

Data sources (all free, no key required)

• OSV.dev — POST https://api.osv.dev/v1/query — unlimited, no key.
• NVD (NIST) — https://services.nvd.nist.gov/rest/json/cves/2.0 — 5 requests / 30 s without a key, 50 / 30 s with a free key. Get one at https://nvd.nist.gov/developers/request-an-api-key and paste it into the optional nvdApiKey input (it is never stored).
• CISA KEV — downloaded once per run into memory and matched locally.

Ecosystems supported by OSV include PyPI, npm, Go, crates.io, Maven, RubyGems, NuGet, Linux and more.

Field reference

Every row carries itemType (finding / cve / kev / setup_guide), mode and queriedAt.

finding (packageScan, vulnDetails): packageName, ecosystem, packageVersion, vulnId, aliases, title, severity, cvssScore, cvssVector, publishedAt, modifiedAt, fixedIn, referencesTop5, kevListed, dataSources.

cve (cveDetails, recentCves): cveId, descriptionEn (truncated to 500 chars), cvssV31, cvssV30, cvssV2, severity, cwe, publishedAt (NVD published), modifiedAt (NVD lastModified), referencesTop5, kevListed, dataSources. recentCves adds isNew: true and baseline.

kev (kevCheck): cveId, kevListed, vendorProject, product, dateAdded, dueDate, knownRansomwareUse, notes.

Notes:

• OSV often ships only the CVSS vector string (e.g. CVSS:3.1/...) without a numeric score. When no numeric score is published, the Actor computes the CVSS v3.1 base score from the vector using the official FIRST formula, so severity is rarely unknown.
• fixedIn lists the fixed versions collected from the advisory's version ranges.
• kevListed is true when the CVE (or any of its aliases) appears in the CISA KEV catalog.
• setup_guide rows are returned instead of an empty dataset when input is missing or a data source fails; the run always exits 0.

Billing

Pay-per-event finding: the first 20 data rows per run are free; further rows charge finding events. Guide/error rows are never charged. Suggested pricing: $0.002 per finding + $0.00005 per Actor start.

Input

• mode — one of packageScan (default), cveDetails, kevCheck, recentCves, vulnDetails.
• packages — e.g. [{"name":"django","ecosystem":"PyPI","version":"3.2.0"}] (version optional).
• cveIds — e.g. ["CVE-2024-3094"] (cveDetails / kevCheck).
• vulnIds — e.g. ["GHSA-2hhj-q8v6-6vj3"] (vulnDetails).
• daysBack — look-back window for recentCves (default 7).
• maxResults — cap on data rows per run (default 50, max 1000).
• nvdApiKey — optional free NVD key to raise the NVD limit from 5 to 50 requests / 30 s.
• includeDetails — enrich each OSV finding with the full advisory (default true).

Local development

python3 -m venv ~/.venvs-vuln
~/.venvs-vuln/bin/pip install -r requirements.txt
cd ~/workspace/apify-projects/vuln-intel-scraper
~/.venvs-vuln/bin/pytest tests/ -q