NVD CVE Scraper

What does NVD CVE Scraper do?

It reads the public NIST National Vulnerability Database (NVD) CVE API 2.0 and returns new or updated CVEs as clean rows: CVE id, published and modified dates, English description, CVSS 4.0 / 3.1 / 2.0 scores, vectors and severity, CWE ids, the CISA KEV (known exploited) flag and due date, affected products (vendor:product from CPE matches), vulnerable CPE strings, advisory and patch links, and a link to the CVE page on nvd.nist.gov.

Price: $1.5 per 1,000 CVEs ($0.0015 per row) plus a tiny start fee. Status rows (nothing matched, API failed) are free.

This product uses the NVD API but is not endorsed or certified by the NVD.

Quick start

1. Run it with the prefilled input: {"daysBack": 3, "maxItems": 20}. That returns up to 20 of the newest CVEs, about $0.03 at $1.5 per 1,000.
2. Export the dataset as CSV, JSON or Excel, or read it through the API.
3. For a CVE feed, turn on Only new since last run and add a daily or hourly schedule: later runs return and charge only CVEs you have not seen before.

Use cases

You want to...	What this actor gives you
A daily or hourly feed of new CVEs for a spreadsheet, Slack or ticket flow	Schedule + Only new since last run.
Filter vulnerabilities	Severity, CWE, keyword and CISA KEV filters; CVSS 4.0 / 3.1 / 2.0 scores and vectors.
Look up a list of CVE ids	Up to 50 CVE ids per run.
Feed a database or AI agent	JSON, CSV, Excel or API output with affected products and advisory links.

Only new since last run

Turn on Only new since last run and schedule the tool. Each run returns (and charges) only CVEs it has not returned to you before. The memory is a key-value store named nvd-cve-scraper-state in your own Apify account. Use Only-new memory name to keep a separate memory per saved search. The first run returns everything that matches (up to Max CVEs).

Input

• Days back: CVEs published in the last N days (default 3, max 120).
• Date field: published (new CVEs) or lastModified (CVEs NVD changed: new scores, products or KEV flag).
• Start date / End date: optional fixed window (YYYY-MM-DD, UTC, max 120 days).
• Keyword, CVSS v3 severity, CWE id, Only CISA KEV: optional filters.
• CVE ids (lookup): optional list of specific CVEs (max 50 per run) instead of a date search.
• Max CVEs: caps the run and your cost. Newest CVEs come first.
• Your NVD API key (optional): a free key from NVD raises the rate limit. It is used only for your runs and never written to the output.

Example:

{"daysBack": 1, "severity": "CRITICAL", "onlyNew": true, "maxItems": 50}

Output (one row per CVE)

{"rowType": "cve", "cveId": "CVE-2026-104016", "published": "2026-10-28T00:17:10.530", "vulnStatus": "Deferred",
 "description": "ProtobufParser parses length-prefixed protobuf string and bytes fields ...",
 "severity": "HIGH", "baseScore": 7.5, "scoreSource": "CVSS 3.1",
 "cvssV31Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK",
 "cwes": ["CWE-190"], "inCisaKev": false, "affectedProducts": ["FasterXML jackson-dataformat-protobuf"],
 "referenceUrls": ["https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-c2rq-mcfv-jw29"],
 "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-104016", "status": "ok"}

(Shortened. Example values from the NVD API on 2026-10-30; live values change. Full field list in the Output tab.)

Download as JSON, CSV, Excel or via the Apify API.

What it does not collect

Only factual vulnerability fields. The tool does not output the reporting organisation's source identifiers (these are often e-mail addresses). E-mail addresses and phone-like numbers inside descriptions are replaced, and reference links that contain an @ are dropped.

How it works

• Reads robots.txt first and obeys it; one request at a time with at least 6 seconds between requests without a key (NVD's own advice), 1.5 seconds with your key; no login, no cookies; redirects are not followed.
• Up to 500 CVEs per request. A 3-day search with Max CVEs 20 is about 3 requests.
• If NVD rate-limits (shared cloud IPs can hit the public limit), the tool waits 35 seconds and retries once, then returns a free fetch-failed row.

Limitations

• Only what NVD publishes. Many brand-new CVEs are still "Awaiting Analysis" or "Deferred", so NVD's own scores, CPEs or CWEs can be empty; the reporter's scores are used when present. Empty fields are left empty, never guessed.
• NVD allows at most 120 days per date search; longer history needs several runs.
• Only new mode remembers CVE ids. With Date field lastModified, a CVE you already got is not returned again when it changes.
• The CISA KEV flag is as NVD shows it; it can lag the CISA catalog.
• Not affiliated with or endorsed by NIST or the NVD.

Changelog

• 2026-10-30: first release.

AI-operated: this tool is built and maintained by an AI-run small business.