NVD CVE Scraper – New Vulnerabilities by Keyword

NVD CVE scraper that pulls newly published vulnerabilities from the official NIST National Vulnerability Database API 2.0. Filter by keyword, exact product (CPE), CVSS severity or the CISA Known Exploited Vulnerabilities list, and get clean rows with score, vector, CWE and references. No API key and no login needed.

What does it do?

• CVE ID, publish and modified dates, status and English description.
• Best available CVSS (v4.0, then v3.1, v3.0 or v2): score, severity and vector.
• CWE weaknesses and whether the CVE is in CISA KEV.
• Up to 10 reference links and the NVD detail URL.

Use cases

• Security alerts: a daily feed of new CVEs for the stack you or your clients use (WordPress, n8n, Shopify apps…).
• Agencies and freelancers: proactive patch notices for client sites.
• Content: weekly "critical CVEs" posts for X, Telegram or newsletters.
• AI agents: feed fresh vulnerability data to an LLM triage workflow.

Input

Field	Description
keyword	Words in the CVE description. Example: wordpress, n8n, openssl
daysBack	NVD allows windows of up to 120 days. Example: 7
severity	Only this severity. Empty = all.
cpeName	Exact product. Example: cpe:2.3:a:wordpress:wordpress:6.4.0:::::::*
onlyKev	Only CVEs in CISA's Known Exploited Vulnerabilities catalog.
maxItems	Example: 100

Example input:

{
  "keyword": "wordpress",
  "daysBack": 14,
  "maxItems": 20
}

Output

Real output (first items of a run on 26 Oct 2026):

[
  {
    "cveId": "CVE-2026-97657",
    "published": "2026-10-14T03:17:37.657",
    "lastModified": "2026-10-14T19:17:23.393",
    "status": "Deferred",
    "description": "The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim's cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user — achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forced on during plugin upgrades, meaning all affected installations are exploitable without any additional configuration.",
    "cvssVersion": "3.1",
    "cvssScore": 9.8,
    "severity": "CRITICAL",
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "cwe": [
      "CWE-639"
    ],
    "inCisaKev": false,
    "kevDateAdded": null,
    "references": [
      "https://www.tychesoftwares.com/docs/docs/abandoned-cart-pro-for-woocommerce-new/changelog-abandoned-cart-pro/",
      "https://www.tychesoftwares.com/products/woocommerce-abandoned-cart-pro-plugin/",
      "https://www.wordfence.com/threat-intel/vulnerabilities/id/b25b4aed-94b2-4c16-8e4e-39aec4e5e22a?source=cve"
    ],
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97657"
  },
  {
    "cveId": "CVE-2026-110002",
    "published": "2026-10-14T03:17:20.220",
    "lastModified": "2026-10-15T17:17:14.920",
    "status": "Deferred",
    "description": "The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The save-to-cache.php script is directly reachable without loading WordPress; FILTER_SANITIZE_URL — the only filter applied to the pluginURL value — preserves the characters required to craft a valid PHP payload, which is then written verbatim into cached-content/cached-feed.php and immediately executable via a single GET request.",
    "cvssVersion": "3.1",
    "cvssScore": 9.8,
    "severity": "CRITICAL",
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "cwe": [
      "CWE-434"
    ],
    "inCisaKev": false,
    "kevDateAdded": null,
    "references": [
      "https://plugins.trac.wordpress.org/browser/snazzy-cacheable-facebook-feed/trunk/functions/save-to-cache.php#L311",
      "https://plugins.trac.wordpress.org/browser/snazzy-cacheable-facebook-feed/trunk/functions/save-to-cache.php#L315",
      "https://plugins.trac.wordpress.org/browser/snazzy-cacheable-facebook-feed/trunk/functions/save-to-cache.php#L328",
      "https://plugins.trac.wordpress.org/browser/snazzy-cacheable-facebook-feed/trunk/functions/save-to-cache.php#L70",
      "https://www.wordfence.com/threat-intel/vulnerabilities/id/98dd1333-81ee-4036-a738-03a3f0a0022d?source=cve"
    ],
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110002"
  }
]

Export the results as JSON, CSV or Excel, read them through the API, or send them to Google Sheets, Make, Zapier, n8n or webhooks. You can also run this Actor from AI agents through the Apify MCP server.

Pricing

Pay per event: $2.00 per 1,000 cves plus $0.00005 per run start. There is no extra platform usage charge.

FAQ

Why is it slow sometimes? Without an API key NVD allows about 5 requests every 30 seconds, so the Actor waits between pages.

Max time window? 120 days per run, an NVD limit.

Is it official? It uses the official API. This product uses the NVD API but is not endorsed or certified by the NVD.

Do I need a login or API key? No. It uses the source's public API; you only need an Apify account.

Can AI agents use it? Yes. Call it through the Apify API, or from Claude, Cursor or any MCP client via the Apify MCP server.

Data source and license

Source: the NVD CVE API 2.0 by NIST. This product uses the NVD API but is not endorsed or certified by the NVD. NVD terms of use: "The NVD API is intended to be used to develop a service or services to search, display, analyze, retrieve, view and otherwise 'get' information from NVD data." The Actor respects the public rate limit.

This Actor is not affiliated with or endorsed by the data source. You are responsible for using the data in line with the source's license and terms.