# NVD CVE Scraper – New Vulnerabilities by Keyword (`fluyeporlaweb/nvd-cve-scraper`) Actor

Scrape new CVEs from the official NIST NVD API by keyword, product (CPE), severity or CISA KEV. CVSS score, CWE, references. Great for security alerts.

- **URL**: https://apify.com/fluyeporlaweb/nvd-cve-scraper.md
- **Developed by:** [Pablo Navarro](https://apify.com/fluyeporlaweb) (community)
- **Categories:** Automation, AI, News
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.00 / 1,000 cves

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## NVD CVE Scraper – New Vulnerabilities by Keyword

**NVD CVE scraper** that pulls **newly published vulnerabilities** from the official NIST National Vulnerability Database API 2.0. Filter by keyword, exact product (CPE), CVSS severity or the CISA Known Exploited Vulnerabilities list, and get clean rows with score, vector, CWE and references. No API key and no login needed.

### What does it do?

- CVE ID, publish and modified dates, status and English description.
- Best available CVSS (v4.0, then v3.1, v3.0 or v2): score, severity and vector.
- CWE weaknesses and whether the CVE is in CISA KEV.
- Up to 10 reference links and the NVD detail URL.

### Use cases

- **Security alerts**: a daily feed of new CVEs for the stack you or your clients use (WordPress, n8n, Shopify apps…).
- **Agencies and freelancers**: proactive patch notices for client sites.
- **Content**: weekly "critical CVEs" posts for X, Telegram or newsletters.
- **AI agents**: feed fresh vulnerability data to an LLM triage workflow.

### Input

| Field | Description |
|---|---|
| `keyword` | Words in the CVE description. Example: wordpress, n8n, openssl |
| `daysBack` | NVD allows windows of up to 120 days. Example: 7 |
| `severity` | Only this severity. Empty = all. |
| `cpeName` | Exact product. Example: cpe:2.3:a:wordpress:wordpress:6.4.0:*:*:*:*:*:*:\* |
| `onlyKev` | Only CVEs in CISA's Known Exploited Vulnerabilities catalog. |
| `maxItems` | Example: 100 |

Example input:

```json
{
  "keyword": "wordpress",
  "daysBack": 14,
  "maxItems": 20
}
```

### Output

Real output (first items of a run on 26 Oct 2026):

```json
[
  {
    "cveId": "CVE-2026-97657",
    "published": "2026-10-14T03:17:37.657",
    "lastModified": "2026-10-14T19:17:23.393",
    "status": "Deferred",
    "description": "The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim's cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user — achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forced on during plugin upgrades, meaning all affected installations are exploitable without any additional configuration.",
    "cvssVersion": "3.1",
    "cvssScore": 9.8,
    "severity": "CRITICAL",
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "cwe": [
      "CWE-639"
    ],
    "inCisaKev": false,
    "kevDateAdded": null,
    "references": [
      "https://www.tychesoftwares.com/docs/docs/abandoned-cart-pro-for-woocommerce-new/changelog-abandoned-cart-pro/",
      "https://www.tychesoftwares.com/products/woocommerce-abandoned-cart-pro-plugin/",
      "https://www.wordfence.com/threat-intel/vulnerabilities/id/b25b4aed-94b2-4c16-8e4e-39aec4e5e22a?source=cve"
    ],
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97657"
  },
  {
    "cveId": "CVE-2026-110002",
    "published": "2026-10-14T03:17:20.220",
    "lastModified": "2026-10-15T17:17:14.920",
    "status": "Deferred",
    "description": "The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The save-to-cache.php script is directly reachable without loading WordPress; FILTER_SANITIZE_URL — the only filter applied to the pluginURL value — preserves the characters required to craft a valid PHP payload, which is then written verbatim into cached-content/cached-feed.php and immediately executable via a single GET request.",
    "cvssVersion": "3.1",
    "cvssScore": 9.8,
    "severity": "CRITICAL",
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "cwe": [
      "CWE-434"
    ],
    "inCisaKev": false,
    "kevDateAdded": null,
    "references": [
      "https://plugins.trac.wordpress.org/browser/snazzy-cacheable-facebook-feed/trunk/functions/save-to-cache.php#L311",
      "https://plugins.trac.wordpress.org/browser/snazzy-cacheable-facebook-feed/trunk/functions/save-to-cache.php#L315",
      "https://plugins.trac.wordpress.org/browser/snazzy-cacheable-facebook-feed/trunk/functions/save-to-cache.php#L328",
      "https://plugins.trac.wordpress.org/browser/snazzy-cacheable-facebook-feed/trunk/functions/save-to-cache.php#L70",
      "https://www.wordfence.com/threat-intel/vulnerabilities/id/98dd1333-81ee-4036-a738-03a3f0a0022d?source=cve"
    ],
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110002"
  }
]
```

Export the results as JSON, CSV or Excel, read them through the API, or send them to Google Sheets, Make, Zapier, n8n or webhooks. You can also run this Actor from AI agents through the Apify MCP server.

### Pricing

Pay per event: **$2.00 per 1,000 cves** plus $0.00005 per run start. There is no extra platform usage charge.

### FAQ

**Why is it slow sometimes?** Without an API key NVD allows about 5 requests every 30 seconds, so the Actor waits between pages.

**Max time window?** 120 days per run, an NVD limit.

**Is it official?** It uses the official API. This product uses the NVD API but is not endorsed or certified by the NVD.

**Do I need a login or API key?** No. It uses the source's public API; you only need an Apify account.

**Can AI agents use it?** Yes. Call it through the Apify API, or from Claude, Cursor or any MCP client via the Apify MCP server.

### Data source and license

Source: the [NVD CVE API 2.0](https://nvd.nist.gov/developers/vulnerabilities) by NIST. **This product uses the NVD API but is not endorsed or certified by the NVD.** [NVD terms of use](https://nvd.nist.gov/developers/terms-of-use): "The NVD API is intended to be used to develop a service or services to search, display, analyze, retrieve, view and otherwise 'get' information from NVD data." The Actor respects the public rate limit.

This Actor is not affiliated with or endorsed by the data source. You are responsible for using the data in line with the source's license and terms.

# Actor input Schema

## `keyword` (type: `string`):

Words in the CVE description. Example: wordpress, n8n, openssl

## `daysBack` (type: `integer`):

NVD allows windows of up to 120 days. Example: 7

## `severity` (type: `string`):

Only this severity. Empty = all.

## `cpeName` (type: `string`):

Exact product. Example: cpe:2.3:a:wordpress:wordpress:6.4.0:*:*:*:*:*:*:\*

## `onlyKev` (type: `boolean`):

Only CVEs in CISA's Known Exploited Vulnerabilities catalog.

## `maxItems` (type: `integer`):

Example: 100

## Actor input object example

```json
{
  "keyword": "wordpress",
  "daysBack": 7,
  "onlyKev": false,
  "maxItems": 100
}
```

# Actor output Schema

## `items` (type: `string`):

No description

## `summary` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "keyword": "wordpress"
};

// Run the Actor and wait for it to finish
const run = await client.actor("fluyeporlaweb/nvd-cve-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "keyword": "wordpress" }

# Run the Actor and wait for it to finish
run = client.actor("fluyeporlaweb/nvd-cve-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "keyword": "wordpress"
}' |
apify call fluyeporlaweb/nvd-cve-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,fluyeporlaweb/nvd-cve-scraper"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/guhKL2YIARBRuzwUt/builds/RDnUe8hMiwP9jO3uo/openapi.json