CVE KEV EPSS API: NVD, CISA KEV and EPSS in One Row

Use this CVE KEV EPSS API to get one row per CVE with the NVD score, the CISA Known Exploited Vulnerabilities (KEV) status and the FIRST EPSS exploit probability for $3.00 per 1,000 rows. Search by CVE ID, by the date CISA added an entry, by EPSS or CVSS score, by publication date, by keyword or by vendor. Every row holds CVSS, CWE, affected products, KEV due date, ransomware use and EPSS in one place.

You need no login, no API key and no proxy. The Actor reads three public sources: the NVD API 2.0 of NIST, the KEV JSON feed of CISA and the EPSS API of FIRST. This is an unofficial tool built by an independent developer. It is not affiliated with, endorsed by or operated by NIST, CISA or FIRST.

This product uses data from the NVD API but is not endorsed or certified by the NVD.

What this CVE KEV EPSS API returns

One row is one CVE. The row joins the three sources on the CVE ID.

• Identity and dates: cveId, published, lastModified, status (the NVD analysis status) and nvdUrl.
• Text: description (English, from the NVD).
• Severity: cvssVersion, cvssScore, cvssSeverity, cvssVector and cvssSource. The Actor takes CVSS 3.1 first, then 4.0, 3.0 and 2.0. Inside one version, the NVD analysis comes before a score from the CNA.
• Weakness and products: cwe (list), vendors, products (vendor:product, up to 10 each), affectedCpeCount, referencesCount and references (the first 5 URLs).
• Known exploited: inKev, kevDateAdded, kevDueDate, kevRequiredAction and kevRansomwareUse (Known or Unknown). These fields are null for a CVE outside the catalog.
• Exploit probability: epssScore, epssPercentile and epssDate.
• Notice: attribution (the NVD notice, the KEV licence and the EPSS citation) and retrievedAt.

Fields that a source does not fill are null. A new CVE often has no CVSS score and no product list for days, so cvssScore and affectedCpeCount are null for it. The row is not dropped. A CVE that has no EPSS score yet has null EPSS fields.

Order of rows

KEV searches return the newest KEV entries first. Date searches return the newest published CVEs first. A search by CVE ID returns the rows in the order of your list.

How to get CVEs with KEV status and EPSS scores, step by step

1. Open the Actor and go to Input.
2. For a list of known CVEs, enter CVE IDs, one per line, such as CVE-2024-3094. Each ID takes one NVD request and about 6 seconds. The limit is 100 IDs.
3. For the newest exploited CVEs, fill KEV added in the last days (the default is 30). Switch on Known exploited only to keep the KEV entries of any other search.
4. Set Minimum EPSS score, for example 0.5, to keep CVEs with a high chance of exploitation. When this is the only search field, the Actor reads the top of the EPSS list.
5. Set Minimum CVSS score, for example 9, Keyword, for example openssl, or Vendor or product, for example fortinet.
6. Open Advanced to use Published after and Published before, Modified after and Modified before, or KEV added after and KEV added before. Switch off Include NVD data to get KEV and EPSS fields only.
7. Set Max results. Start small, for example 10.
8. Start the run. Download the rows as JSON, CSV or Excel, or read them through the API.
9. Schedule the Actor to run every day or every week to keep a list of new KEV entries.

The Actor sends one request at a time to each source. Calls to the NVD are 6 seconds apart. This follows the NVD guide, which names a public limit of 5 requests in a rolling 30 second window without an API key and recommends a 6 second sleep. A search by KEV date or by keyword needs one NVD request per 500 CVEs, so it is fast. A search by CVE ID needs one NVD request per ID.

Run it every day

Switch on Only new since the last run to get each CVE once. A daily run then returns only the CVEs that earlier runs of the same monitor did not deliver.

1. Open the Actor, fill the search fields, for example KEV added in the last days = 7 and Known exploited only.
2. Switch on Only new since the last run and type a Monitor name, for example kev-daily.
3. Save the input as a Task.
4. In the Apify Console go to Schedules, choose Create new, pick the Task and enter a cron expression for once a day, for example 0 7 * * *.

The first run returns everything that matches and becomes the baseline. Every later run returns only new CVEs. The memory lives in a key-value store in your own account named cve-monitor-<monitorName> (letters are lower case). It holds CVE IDs only, no CVE content. A CVE counts as delivered when it is saved to the dataset, so a CVE that Max results cut off in one run comes in the next run. CVEs that the memory skips cost no row price.

Use one Monitor name per saved Task. The memory is also split by the search fields, so the same name with other filters starts a new baseline. The name is checked only when Only new since the last run is on. A CVE is delivered once. A later change of its score or KEV status does not deliver it again.

Worked example with the prices of this page: a Task with KEV added in the last days = 7 and about 8 rows a week (the figure from the weekly digest above). The first run costs 8 x $0.003 + $0.00005 = $0.02405. The next 29 daily runs return about 29 x 8 / 7 = 33 new rows, which cost 33 x $0.003 + 29 x $0.00005 = $0.10045. One month costs about $0.02405 + $0.10045 = $0.1245. The same Task without Only new since the last run returns the whole 7 day window every day: 30 x $0.02405 = $0.7215. The row counts depend on how many entries CISA adds, so your cost differs.

Each run writes the counts (new delivered, already delivered and skipped, first run) to the monitor part of the STATS record and to the final status message.

Bulk lists

For a long list of CVE IDs, give a Dataset or a file instead of typing the IDs.

• Dataset with the list: pick an Apify Dataset. Field in the dataset names the field that holds the CVE ID, for example cveId. Leave it empty to use the first text field.
• List file URL: the web address of a .txt, .csv or .json file. A .txt file has one ID per line. A .csv file uses the first column. A .json file is an array. A header row is skipped. The file can be up to 10 MB.

The IDs from the CVE IDs field, the Dataset and the file are joined and de-duplicated. The limit of 100 IDs applies to the joined list. The CVE IDs field can stay empty. The price per row is the same, and each ID takes one NVD request, about 6 seconds. Together with Only new since the last run, a list that grows over time costs an NVD request and a row only for the IDs added since the last run.

CVE KEV EPSS API pricing

The price is $0.003 per CVE row ($3.00 per 1,000 rows) on the Free plan, plus $0.00005 for each run start. Paid Apify plans pay less per row: $0.0027 (Bronze), $0.0024 (Silver) and $0.0021 (Gold), which is $2.70, $2.40 and $2.10 per 1,000. Only a row saved to the dataset is charged. A run that finds nothing, a run with a wrong input and a run that stops on a source error charge the start fee and no row.

Worked example on the Free plan: a weekly digest of KEV entries added in the last 7 days returns about 8 rows. Cost is 8 x $0.003 + $0.00005 = $0.02405 per run, and 4 weekly runs cost 4 x $0.02405 = $0.0962 per month. A one-off pull of the whole KEV catalog (1,739 CVEs on 11.10.2026) costs 1,739 x $0.003 + $0.00005 = $5.21705. Set Max results or the maximum charge of the run to cap the cost. The Actor stops when the limit is reached.

Input example

This is the input of the Task below. It returns the 10 newest KEV entries of the last 14 days.

{
  "kevAddedLastDays": 14,
  "maxResults": 10
}

A search by CVE ID, with the two CVEs below, looks like this.

{
  "cveIds": ["CVE-2024-3094", "CVE-2021-44228"]
}

Output example

Both rows come from real runs of this Actor against the live sources on 11.10.2026. The first row is a CVE that is not in KEV (CVE ID search, 3 NVD requests, 13 seconds).

{
  "cveId": "CVE-2024-3094",
  "published": "2024-03-29T17:15:21.150Z",
  "lastModified": "2026-06-17T07:43:17.830Z",
  "status": "Modified",
  "description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.",
  "cvssVersion": "3.1",
  "cvssScore": 10,
  "cvssSeverity": "CRITICAL",
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "cvssSource": "nvd@nist.gov",
  "cwe": ["CWE-506"],
  "vendors": ["tukaani"],
  "products": ["tukaani:xz"],
  "affectedCpeCount": 2,
  "referencesCount": 59,
  "references": [
    "https://access.redhat.com/security/cve/CVE-2024-3094",
    "https://bugzilla.redhat.com/show_bug.cgi?id=2272210",
    "https://www.openwall.com/lists/oss-security/2024/03/29/4",
    "https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users",
    "http://www.openwall.com/lists/oss-security/2024/03/29/10"
  ],
  "inKev": false,
  "kevDateAdded": null,
  "kevDueDate": null,
  "kevRequiredAction": null,
  "kevRansomwareUse": null,
  "epssScore": 0.85974,
  "epssPercentile": 0.99727,
  "epssDate": "2026-10-10",
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3094",
  "attribution": "This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). See EPSS at https://www.first.org/epss",
  "retrievedAt": "2026-10-11T12:44:22.687Z"
}

The second row is the first row of the default run (KEV added in the last 30 days, 10 rows, 1 NVD request, 2 seconds). Some fields are left out of this copy, and kevRequiredAction is cut with "..." to save space. The real row has all fields.

{
  "cveId": "CVE-2015-3306",
  "published": "2015-05-18T15:59:10.743Z",
  "lastModified": "2026-10-09T16:17:18.210Z",
  "status": "Analyzed",
  "description": "The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.",
  "cvssVersion": "3.1",
  "cvssScore": 10,
  "cvssSeverity": "CRITICAL",
  "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
  "cwe": ["CWE-284"],
  "vendors": ["fedoraproject", "debian", "opensuse", "suse", "proftpd"],
  "affectedCpeCount": 10,
  "referencesCount": 15,
  "inKev": true,
  "kevDateAdded": "2026-10-08",
  "kevDueDate": "2026-10-11",
  "kevRequiredAction": "Apply mitigations in accordance with vendor instructions, ...",
  "kevRansomwareUse": "Unknown",
  "epssScore": 0.99497,
  "epssPercentile": 0.99945,
  "epssDate": "2026-10-10"
}

Each run also writes a STATS record in the key-value store with the KEV catalog version, the requests per source, the retries, the filters that removed rows, the duration and the peak memory.

Data sources, licences and notices

• NVD (NIST National Vulnerability Database), API 2.0, read without an API key. The NVD terms ask services to show this notice: "This product uses data from the NVD API but is not endorsed or certified by the NVD." The Actor reformats NVD data: it flattens fields, picks one CVSS score, counts references and shortens lists. The rows are not NVD publications. Open the nvdUrl of a row for the original record.
• CISA Known Exploited Vulnerabilities Catalog. CISA publishes the catalog under the Creative Commons CC0 1.0 licence. Use of the data does not allow use of the CISA logo or the DHS seal and does not imply endorsement. The Actor reads the CISA JSON feed. When the CISA site refuses the request, it reads the official CISA copy on GitHub.
• FIRST EPSS (Exploit Prediction Scoring System). FIRST grants the use of EPSS scores freely to the public and asks for attribution. See EPSS at https://www.first.org/epss
• This Actor is not affiliated with, endorsed by or operated by NIST, CISA, FIRST or MITRE. The names are used only to name the sources.

Limits and reliability

• The NVD public limit without a key is shared by every client on one IP address. When the NVD answers with 403 or 429, the Actor waits one window (or the Retry-After time) and tries again up to 2 times. Then it stops, saves one error item and charges nothing. It never changes IP address, never rotates proxies and never uses a key. Switch off Include NVD data to get KEV and EPSS fields at once.
• The NVD reads at most 119 days per request. A longer published or modified range is split into windows of 119 days, newest first. A range above 8 windows (about 952 days) is refused with a message.
• A run stops after 80 NVD requests. Narrow the dates to read more.
• The EPSS API answers with an empty list when a request holds more than 100 CVE IDs. The Actor sends 100 at most.
• The Actor keeps the CVE IDs it has saved. After a restart on another server it skips them and counts them toward Max results.

Related Actors

• Tech Stack Detector: finds the technologies a website runs. Take a product name from it and search it here with Vendor or product.
• DNS Lookup: bulk DNS records, MX, SPF and DMARC for the domains you check.

FAQ

Is it legal to get this data?

The three sources are public and published for reuse. CISA publishes the KEV catalog under CC0 1.0. FIRST grants the use of EPSS scores freely and asks for attribution, which every row carries. The NVD offers its API for this kind of use and asks for a notice, which every row and this page carry. The Actor sends no key, keeps to the public NVD limit and does not try to get around it. It returns no personal data. This is not legal advice. Read the terms of each source for your own use.

Do I need an NVD API key?

No. The Actor works without a key and keeps to the public limit of the NVD. Reads by KEV date or by keyword need few requests. A list of CVE IDs needs one request per ID, so 100 IDs take about 10 minutes.

Why is cvssScore null for a new CVE?

The NVD scores a CVE some time after it appears. Until then the score is null. The row is still returned and is charged as one row. Use Minimum CVSS score to leave such CVEs out.

Why does a KEV row show a score and a due date from different sources?

The KEV fields come from the CISA catalog and the CVSS fields come from the NVD. The row shows both. The kevDueDate is the date by which US federal agencies must fix the CVE. It is not a due date for you.

What does epssScore mean?

EPSS is the estimated probability, from 0 to 1, that a CVE is exploited in the next 30 days. epssPercentile is the share of CVEs with a lower score. Both change every day. epssDate tells you the day of the score.

A run returned fewer rows than Max results. Why?

Fewer CVEs matched the filters. Open the STATS record to see how many CVEs were read and which filter removed rows. A CVE ID that the NVD does not know is listed under notFound and is not charged.

The run saved one error item. What now?

The error code tells the cause. invalid_input means a field has a wrong value, and the message lists every problem. nvd_limit means the NVD public limit is used up on this IP address: run again later or switch off Include NVD data. range_not_usable means the date range needs more than 8 requests. source_error means a source did not answer after retries. An error item is never charged.

If this saved you time, a rating helps others find it. I built and maintain this Actor myself. Send problems and ideas through the Issues tab.