# Vulnerability Intel — CVE, OSV, NVD & KEV Tracker (`celebrated-quadraphonic/vuln-intel-scraper`) Actor

Vulnerability intelligence from free official sources: scan packages against OSV.dev, look up CVE details from NVD, check the CISA Known Exploited Vulnerabilities catalog, and monitor newly published CVEs. No browser, no proxies, zero anti-bot blocks, no API key required.

- **URL**: https://apify.com/celebrated-quadraphonic/vuln-intel-scraper.md
- **Developed by:** [XiaoZhi DataTools](https://apify.com/celebrated-quadraphonic) (community)
- **Categories:** Developer tools, Business, Automation
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.00 / 1,000 vulnerability findings

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Vulnerability Intel — CVE, OSV, NVD & KEV Tracker

Pure-HTTP vulnerability intelligence from free official sources. No browser, no proxies, zero anti-bot blocks, no API key required.

### What it does

| Mode | Description |
|---|---|
| `packageScan` | Scan package versions against **OSV.dev** (Google-backed distributed vulnerability database). One row per known vulnerability. Omit `version` to list every known vulnerability for a package. |
| `cveDetails` | Full CVE records from the **NIST NVD**: English description, CVSS v3.1 / v3.0 / v2 scores, severity, CWE weaknesses, references. |
| `kevCheck` | Check CVE IDs against the **CISA Known Exploited Vulnerabilities** catalog — vulnerabilities with confirmed in-the-wild exploitation, including known ransomware use. |
| `recentCves` | Monitor newly published CVEs via NVD (`pubStartDate` look-back). Results are deduplicated against a persistent store, so each run returns only the CVEs you have not seen yet. First run marks everything `baseline: true`. |
| `vulnDetails` | Fetch full OSV advisory records by ID (`GHSA-*`, `OSV-*`, `CVE-*`). |

GitHub Advisory data needs no separate mode: OSV records carry `GHSA-*` IDs in their `aliases` field.

### Data sources (all free, no key required)

- **OSV.dev** — `POST https://api.osv.dev/v1/query` — unlimited, no key.
- **NVD (NIST)** — `https://services.nvd.nist.gov/rest/json/cves/2.0` — 5 requests / 30 s without a key, 50 / 30 s with a free key. Get one at https://nvd.nist.gov/developers/request-an-api-key and paste it into the optional `nvdApiKey` input (it is never stored).
- **CISA KEV** — downloaded once per run into memory and matched locally.

Ecosystems supported by OSV include PyPI, npm, Go, crates.io, Maven, RubyGems, NuGet, Linux and more.

### Field reference

Every row carries `itemType` (`finding` / `cve` / `kev` / `setup_guide`), `mode` and `queriedAt`.

**finding** (packageScan, vulnDetails): `packageName`, `ecosystem`, `packageVersion`, `vulnId`, `aliases`, `title`, `severity`, `cvssScore`, `cvssVector`, `publishedAt`, `modifiedAt`, `fixedIn`, `referencesTop5`, `kevListed`, `dataSources`.

**cve** (cveDetails, recentCves): `cveId`, `descriptionEn` (truncated to 500 chars), `cvssV31`, `cvssV30`, `cvssV2`, `severity`, `cwe`, `publishedAt` (NVD `published`), `modifiedAt` (NVD `lastModified`), `referencesTop5`, `kevListed`, `dataSources`. recentCves adds `isNew: true` and `baseline`.

**kev** (kevCheck): `cveId`, `kevListed`, `vendorProject`, `product`, `dateAdded`, `dueDate`, `knownRansomwareUse`, `notes`.

Notes:

- OSV often ships only the CVSS vector string (e.g. `CVSS:3.1/...`) without a numeric score. When no numeric score is published, the Actor computes the CVSS v3.1 base score from the vector using the official FIRST formula, so `severity` is rarely `unknown`.
- `fixedIn` lists the fixed versions collected from the advisory's version ranges.
- `kevListed` is `true` when the CVE (or any of its aliases) appears in the CISA KEV catalog.
- `setup_guide` rows are returned instead of an empty dataset when input is missing or a data source fails; the run always exits 0.

### Billing

Pay-per-event `finding`: the first **20 data rows per run are free**; further rows charge `finding` events. Guide/error rows are never charged. Suggested pricing: **$0.002 per finding** + **$0.00005 per Actor start**.

### Input

- `mode` — one of `packageScan` (default), `cveDetails`, `kevCheck`, `recentCves`, `vulnDetails`.
- `packages` — e.g. `[{"name":"django","ecosystem":"PyPI","version":"3.2.0"}]` (`version` optional).
- `cveIds` — e.g. `["CVE-2024-3094"]` (cveDetails / kevCheck).
- `vulnIds` — e.g. `["GHSA-2hhj-q8v6-6vj3"]` (vulnDetails).
- `daysBack` — look-back window for `recentCves` (default 7).
- `maxResults` — cap on data rows per run (default 50, max 1000).
- `nvdApiKey` — optional free NVD key to raise the NVD limit from 5 to 50 requests / 30 s.
- `includeDetails` — enrich each OSV finding with the full advisory (default true).

### Local development

```bash
python3 -m venv ~/.venvs-vuln
~/.venvs-vuln/bin/pip install -r requirements.txt
cd ~/workspace/apify-projects/vuln-intel-scraper
~/.venvs-vuln/bin/pytest tests/ -q
```

# Actor input Schema

## `cveIds` (type: `array`):

CVE IDs for cveDetails / kevCheck modes, e.g. \["CVE-2024-3094"].

## `daysBack` (type: `integer`):

For recentCves mode: how many days back to look for newly published CVEs.

## `includeDetails` (type: `boolean`):

When enabled, each OSV finding is enriched with the full advisory (details, references). Disable to save requests.

## `maxResults` (type: `integer`):

Maximum data rows collected per run (pagination is automatic).

## `mode` (type: `string`):

What to do: scan packages for known vulnerabilities (OSV), look up CVE details (NVD), check CISA KEV listing, monitor newly published CVEs, or fetch full OSV advisory records.

## `nvdApiKey` (type: `string`):

Optional free NVD API key (https://nvd.nist.gov/developers/request-an-api-key). Without it NVD allows 5 requests per 30 seconds; with it, 50. We never store it.

## `packages` (type: `array`):

Packages to scan, e.g. \[{"name":"django","ecosystem":"PyPI","version":"3.2.0"}]. Version is optional: omit it to list every known vulnerability for the package. Ecosystem examples: PyPI, npm, Go, crates.io, Maven, RubyGems, NuGet.

## `vulnIds` (type: `array`):

OSV / GHSA advisory IDs for vulnDetails mode, e.g. \["GHSA-2hhj-q8v6-6vj3"].

## Actor input object example

```json
{
  "cveIds": [],
  "daysBack": 7,
  "includeDetails": true,
  "maxResults": 50,
  "mode": "packageScan",
  "nvdApiKey": "",
  "packages": [
    {
      "ecosystem": "PyPI",
      "name": "django",
      "version": "3.2.0"
    }
  ],
  "vulnIds": []
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "cveIds": [],
    "daysBack": 7,
    "includeDetails": true,
    "maxResults": 50,
    "mode": "packageScan",
    "nvdApiKey": "",
    "packages": [
        {
            "ecosystem": "PyPI",
            "name": "django",
            "version": "3.2.0"
        }
    ],
    "vulnIds": []
};

// Run the Actor and wait for it to finish
const run = await client.actor("celebrated-quadraphonic/vuln-intel-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "cveIds": [],
    "daysBack": 7,
    "includeDetails": True,
    "maxResults": 50,
    "mode": "packageScan",
    "nvdApiKey": "",
    "packages": [{
            "ecosystem": "PyPI",
            "name": "django",
            "version": "3.2.0",
        }],
    "vulnIds": [],
}

# Run the Actor and wait for it to finish
run = client.actor("celebrated-quadraphonic/vuln-intel-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "cveIds": [],
  "daysBack": 7,
  "includeDetails": true,
  "maxResults": 50,
  "mode": "packageScan",
  "nvdApiKey": "",
  "packages": [
    {
      "ecosystem": "PyPI",
      "name": "django",
      "version": "3.2.0"
    }
  ],
  "vulnIds": []
}' |
apify call celebrated-quadraphonic/vuln-intel-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,celebrated-quadraphonic/vuln-intel-scraper"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/oGXfgdFL0PloePt5P/builds/sPntSF9jAgsfsR7cG/openapi.json