CVElens Vulnerability Intelligence

One record per CVE with everything you need to decide whether it matters:

• NVD: description, CVSS v4 / v3.1 / v3.0 / v2 with vectors, CWE, affected vendors and products
• CISA KEV: known-exploited status, date added, remediation due date, known ransomware use
• EPSS (FIRST.org): probability of exploitation within 30 days, with percentile, updated daily
• Public exploits: Exploit-DB entries, Metasploit modules and Nuclei templates, with links
• Risk score: 0 to 100 with every contributing factor listed, so you can explain a priority

Served from a continuously synced mirror of 390,000+ CVEs. Complete where NVD is not: KEV, EPSS and exploit data are present even for CVEs NVD has not scored yet, and those say unscored instead of pretending to be low risk.

Modes

Mode	What you get	Inputs
Look up CVE ids	One record per id, up to 1,000 per run	cveIds
Search and filter	Records matching your filters, newest first by default	vendor, product, kevOnly, exploitOnly, epssMin, cvssMin, severity, cwe, publishedSince, modifiedSince, query, sort, maxItems
Recent CISA KEV additions	The KEV catalog, newest first	publishedSince (added since), vendor, ransomwareOnly, maxItems
Top EPSS scores	Highest exploit probabilities	excludeKev, maxItems (up to 200)

Examples

Which Cisco CVEs are being exploited and have public exploit code, worst first? Mode: search · vendor cisco · kevOnly · exploitOnly · sort epss.

Everything CISA added this week: Mode: kev · publishedSince 2026-09-15.

What is likely to be exploited next but not yet in KEV: Mode: epss_top · excludeKev · maxItems 100.

Enrich my scanner's findings: Mode: lookup · paste the ids.

Output

Each dataset row is one CVE, flat columns first so the table view is scannable, then the full nested record:

{
  "id": "CVE-2021-44228",
  "risk_score": 100,
  "risk_level": "critical",
  "cvss_score": 10.0,
  "cvss_severity": "CRITICAL",
  "cvss_version": "3.1",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.99999,
  "epss_percentile": 1.0,
  "kev_listed": true,
  "kev_date_added": "2021-12-10",
  "kev_due_date": "2021-12-24",
  "kev_ransomware": "Known",
  "exploit_count": 9,
  "exploit_sources": ["exploitdb", "metasploit", "nuclei"],
  "published": "2021-12-10",
  "last_modified": "2026-08-11",
  "status": "Analyzed",
  "vendors": "apache, apple, cisco, debian, ...",
  "cwe": ["CWE-20", "CWE-400", "CWE-502", "CWE-917"],
  "description": "Apache Log4j2 2.0-beta9 through 2.15.0 ...",
  "risk_factors": [{"factor": "cvss_v3.1", "value": 10.0, "points": 50}, {"factor": "epss", "value": 0.99999, "points": 25}, {"factor": "cisa_kev", "value": "ransomware", "points": 20}, {"factor": "public_exploit", "value": ["exploitdb", "metasploit", "nuclei"], "points": 10}],
  "cvss_all": {"v4": null, "v3_1": {"score": 10.0, "...": "..."}, "v2": {"score": 9.3, "...": "..."}},
  "kev": {"vendor_project": "Apache", "product": "Log4j2", "required_action": "...", "...": "..."},
  "exploits": [{"source": "metasploit", "ref": "exploit/multi/http/log4shell_header_injection", "url": "https://github.com/rapid7/...", "verified": true}],
  "affected_products": [{"vendor": "apache", "product": "log4j"}],
  "cpe_count": 373,
  "found": true
}

Ids that exist in no source are pushed as {"id": "...", "found": false} and are not charged. includeReferences adds the NVD reference URLs; includeCpes adds up to 50 CPE match strings.

Risk score

Factor	Points
Best available CVSS base score	0 to 50 (score / 10 × 50)
EPSS probability	0 to 25 (epss × 25)
Listed in CISA KEV	+15, or +20 with known ransomware use
Public exploit code	+10 for Metasploit or Exploit-DB, +5 for Nuclei template only

Capped at 100. Levels: critical ≥ 80, high ≥ 60, medium ≥ 35, low otherwise, and unscored when no source has anything yet.

Pricing

Pay per event: each CVE record returned is one cve-record event. Records not found are free. Use maxItems to cap a run, or the run's maximum total charge in Apify; the Actor stops cleanly at the limit and keeps what it already fetched.

Use with AI agents

Every Apify Actor is available as a tool through the Apify MCP server, so you can ask an agent "which Cisco CVEs in KEV have public exploit code, ranked by EPSS?" and it will call this Actor. The same data is also available directly as a REST API and a first-party MCP endpoint at api.cvelens.com, also on RapidAPI.

Data sources and freshness

NIST NVD (continuous, by modification date) · CISA KEV (hourly, CC0) · FIRST EPSS (hourly; scores update daily) · Exploit-DB, Rapid7 Metasploit, ProjectDiscovery Nuclei (hourly). CVElens is not affiliated with any of these organisations. Risk scores are informational and do not replace your own assessment.

Questions: support@cvelens.com