CVE Vulnerability Lookup

Look up any CVE by ID straight from the official NVD database — description, CVSS score & severity, CWE, affected products, and references in clean JSON.

Live on the Apify Store — run it instantly or call it as an agent tool via Apify MCP.

What you get

For each CVE id you pass:

• description — the official NVD English summary
• cvss — base score (0–10) plus severity (LOW/MEDIUM/HIGH/CRITICAL), vector, and CVSS cvssVersion (3.1 → 3.0 → 2.0 fallback)
• cwe — weakness classifications (e.g. CWE-502)
• published / modified — NVD timestamps and status
• affectedCpes — affected product CPE strings
• references — vendor advisories, patches, and writeups

Accepts a single cve or a bulk cves array. Invalid ids and not-found CVEs are reported per-item, so one bad input never breaks the run. NVD rate limits are handled with automatic backoff.

Input

{
  "cve": "CVE-2021-44228",
  "cves": ["CVE-2014-0160"],
  "maxItems": 25
}

Output

{
  "cve": "CVE-2021-44228",
  "found": true,
  "description": "Apache Log4j2 ... JNDI features ... do not protect against attacker controlled LDAP ...",
  "cvss": 10.0,
  "cvssVersion": "3.1",
  "severity": "CRITICAL",
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "cwe": ["CWE-502", "CWE-400", "CWE-20"],
  "published": "2021-12-10T10:15:09.143",
  "modified": "2023-11-07T03:17:14.683",
  "status": "Analyzed",
  "affectedCpes": ["cpe:2.3:a:apache:log4j:2.0:*:*:*:*:*:*:*"],
  "references": ["https://logging.apache.org/log4j/2.x/security.html"]
}