# CVE Risk Enricher - NVD, CISA KEV & EPSS Priority 💰$3/1k (`flyingnimbus/cve-risk-enricher`) Actor

Turn a list of CVE IDs, or npm and PyPI packages, into a ranked patch list. Each CVE gets its CVSS score, CISA known-exploited status, EPSS exploit probability, CWE weaknesses, affected products and a plain-language priority.

- **URL**: https://apify.com/flyingnimbus/cve-risk-enricher.md
- **Developed by:** [Rakshit Solanki](https://apify.com/flyingnimbus) (community)
- **Categories:** Developer tools, Other
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$3.00 / 1,000 cve enricheds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CVE Risk Enricher - NVD, CISA KEV & EPSS

Turn a list of CVE IDs, or npm and PyPI packages, into a ranked patch list. Each CVE gets its CVSS score, CISA known-exploited status, EPSS exploit probability, CWE weaknesses, affected products and a plain-language priority.

### What does CVE Risk Enricher - NVD, CISA KEV & EPSS do?

- NVD CVSS and descriptions
- CISA Known Exploited Vulnerabilities flag with due date and ransomware use
- FIRST EPSS probability and percentile
- OSV lookup: pass packages like npm:lodash@4.17.20 to find their CVEs first

### How to use it

1. Click **Try for free** and open the **Input** tab.
2. Fill in the fields below, or keep the defaults for a quick test.
3. Press **Start**. Results appear in the **Output** tab within seconds to a few minutes.
4. Download as JSON, CSV or Excel, or call the actor from the API, a schedule, Make, Zapier or an AI agent through the Apify MCP server.

### Input

| Field | Type | Description |
|---|---|---|
| `cveIds` | array | CVE IDs, one per line (text containing IDs also works). |
| `packages` | array | Look up known CVEs via OSV. Format ecosystem:name@version, e.g. npm:lodash@4.17.20 or pypi:django@3.2. |
| `maxCves` | integer | Cap per run. Without an NVD key lookups take about 6 seconds each. |

#### Example input

```json
{
  "cveIds": [
    "CVE-2021-44228",
    "CVE-2023-4863"
  ],
  "packages": [],
  "maxCves": 25
}
```

### Output

Each result is a flat JSON object that you can open in the **Output** tab, export to CSV or Excel, or read through the API. See the dataset views for the main columns.

### How much does it cost to use CVE Risk Enricher - NVD, CISA KEV & EPSS?

Pricing is pay per event: **$0.003 per CVE (unknown CVEs are free)**. You pay only for results saved to the dataset, plus nothing extra for platform usage on the free plan limits. Apify's free monthly credit lets you test it before paying.

### FAQ

**Why is it slow without a key?**  NVD allows one request every six seconds without a key. Add an NVD API key to speed it up.

**What does priority mean?**  Critical means CISA lists it as exploited. High means likely exploited by EPSS. Medium and low follow CVSS and EPSS.

**Does it scan my code?**  No. It enriches IDs and package versions you provide.

### Is it legal?

The actor reads public, open-licence or government data only and does not collect private information. You are responsible for using the results in line with the source's terms and applicable laws.

### Use it with AI agents (MCP)

This actor is agent-ready: it is a plain tool with a documented JSON input and a flat JSON output, so Claude, ChatGPT, Cursor and other agents can call it through the [Apify MCP server](https://mcp.apify.com).

Add it to an MCP client with this URL (Apify account or agentic payment required):

```
https://mcp.apify.com/?tools=flyingnimbus/cve-risk-enricher
```

Example prompt: "Use the CVE Risk Enricher - NVD, CISA KEV & EPSS tool with the example input below and summarise the results."

Calls are pay per event ($0.003 per CVE (unknown CVEs are free)), so an agent can estimate the cost before it runs. Empty or failed lookups return a status record instead of failing the run.

### More actors by flyingnimbus

- [Property Details by Address API](https://apify.com/flyingnimbus/property-details-by-address-api)
- [Schools Near Address Finder API](https://apify.com/flyingnimbus/schools-near-address-finder)
- [School Rating Converter & Equivalence API](https://apify.com/flyingnimbus/school-rating-normalizer)
- [Building Permits Multi-City API](https://apify.com/flyingnimbus/building-permits-multi-city)
- [Company Registry Lookup (LEI + SEC)](https://apify.com/flyingnimbus/company-registry-lookup)
- [Restaurant Inspections API - NYC, Chicago, Toronto](https://apify.com/flyingnimbus/restaurant-inspections-multi-city)
- [SEC Insider Trades (Form 4) - Buys & Sells](https://apify.com/flyingnimbus/sec-insider-trades)
- [SEC 13F Holdings Tracker](https://apify.com/flyingnimbus/sec-13f-holdings)
- [EU Company Registry Search](https://apify.com/flyingnimbus/eu-company-registry-search)
- [Canada Recalls & Safety Alerts Monitor](https://apify.com/flyingnimbus/canada-recalls-monitor)
- [Sitemap & Robots.txt Analyzer](https://apify.com/flyingnimbus/sitemap-robots-analyzer)
- [Email Validator - MX, SPF & DMARC](https://apify.com/flyingnimbus/email-mx-validator)
- [Website Tech Stack Detector](https://apify.com/flyingnimbus/tech-stack-detector)
- [PDF Text & Table Extractor](https://apify.com/flyingnimbus/pdf-table-extractor)
- [URL to Markdown + Metadata](https://apify.com/flyingnimbus/url-to-markdown-metadata)
- [SSL Certificate Expiry Checker](https://apify.com/flyingnimbus/ssl-certificate-checker)
- [VIN Decoder + Recalls API](https://apify.com/flyingnimbus/vin-decoder-recalls)
- [ClinicalTrials.gov Search API](https://apify.com/flyingnimbus/clinical-trials-search)
- [US Federal Contracts & Grants (USAspending)](https://apify.com/flyingnimbus/federal-contract-awards)
- [Federal Register Search API](https://apify.com/flyingnimbus/federal-register-search)
- [FDA Recalls & Drug Labels API](https://apify.com/flyingnimbus/openfda-recalls-labels)
- [Eurostat Data API](https://apify.com/flyingnimbus/eurostat-data-api)
- [UK Government Tenders (Contracts Finder)](https://apify.com/flyingnimbus/uk-tenders-search)

### Feedback

Found a bug or need another field or city? Open an issue on the actor's **Issues** tab and it will be looked at quickly.

# Actor input Schema

## `cveIds` (type: `array`):

CVE IDs, one per line (text containing IDs also works).

## `packages` (type: `array`):

Look up known CVEs via OSV. Format ecosystem:name@version, e.g. npm:lodash@4.17.20 or pypi:django@3.2.

## `maxCves` (type: `integer`):

Cap per run. Without an NVD key lookups take about 6 seconds each.

## Actor input object example

```json
{
  "cveIds": [
    "CVE-2021-44228",
    "CVE-2023-4863"
  ],
  "packages": [],
  "maxCves": 25
}
```

# Actor output Schema

## `results` (type: `string`):

One row per result.

## `overview` (type: `string`):

Key columns.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "cveIds": [
        "CVE-2021-44228",
        "CVE-2023-4863"
    ],
    "maxCves": 25
};

// Run the Actor and wait for it to finish
const run = await client.actor("flyingnimbus/cve-risk-enricher").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "cveIds": [
        "CVE-2021-44228",
        "CVE-2023-4863",
    ],
    "maxCves": 25,
}

# Run the Actor and wait for it to finish
run = client.actor("flyingnimbus/cve-risk-enricher").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "cveIds": [
    "CVE-2021-44228",
    "CVE-2023-4863"
  ],
  "maxCves": 25
}' |
apify call flyingnimbus/cve-risk-enricher --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,flyingnimbus/cve-risk-enricher"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/L07bwsoDRTZt3iss0/builds/Jdh7YGCuqiaCoSim9/openapi.json