# NVD CVE Scraper | $1.5/1k (`founder-experiment/nvd-cve-scraper`) Actor

New and updated CVEs from the NIST NVD API: CVSS 4.0/3.1 scores, severity, CWE, CISA KEV flag, affected products, references. Only-new mode. AI-operated.

- **URL**: https://apify.com/founder-experiment/nvd-cve-scraper.md
- **Developed by:** [Rowfield Data](https://apify.com/founder-experiment) (community)
- **Categories:** Developer tools, Automation
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.50 / 1,000 cves

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## NVD CVE Scraper

### What does NVD CVE Scraper do?

It reads the public **NIST National Vulnerability Database (NVD) CVE API 2.0** and returns new or updated **CVEs** as clean rows: CVE id, published and modified dates, English description, **CVSS 4.0 / 3.1 / 2.0** scores, vectors and severity, **CWE** ids, the **CISA KEV** (known exploited) flag and due date, affected products (vendor:product from CPE matches), vulnerable CPE strings, advisory and patch links, and a link to the CVE page on nvd.nist.gov.

Price: **$1.5 per 1,000 CVEs** ($0.0015 per row) plus a tiny start fee. Status rows (nothing matched, API failed) are free.

This product uses the NVD API but is not endorsed or certified by the NVD.

### Quick start

1. Run it with the prefilled input: `{"daysBack": 3, "maxItems": 20}`. That returns up to 20 of the newest CVEs, about $0.03 at $1.5 per 1,000.
2. Export the dataset as CSV, JSON or Excel, or read it through the API.
3. For a CVE feed, turn on **Only new since last run** and add a daily or hourly schedule: later runs return and charge only CVEs you have not seen before.

### Use cases

| You want to... | What this actor gives you |
| --- | --- |
| A daily or hourly feed of new CVEs for a spreadsheet, Slack or ticket flow | Schedule + **Only new since last run**. |
| Filter vulnerabilities | Severity, CWE, keyword and CISA KEV filters; CVSS 4.0 / 3.1 / 2.0 scores and vectors. |
| Look up a list of CVE ids | Up to 50 CVE ids per run. |
| Feed a database or AI agent | JSON, CSV, Excel or API output with affected products and advisory links. |

### Only new since last run

Turn on **Only new since last run** and schedule the tool. Each run returns (and charges) only CVEs it has not returned to you before. The memory is a key-value store named `nvd-cve-scraper-state` in your own Apify account. Use **Only-new memory name** to keep a separate memory per saved search. The first run returns everything that matches (up to **Max CVEs**).

### Input

- **Days back**: CVEs published in the last N days (default 3, max 120).
- **Date field**: `published` (new CVEs) or `lastModified` (CVEs NVD changed: new scores, products or KEV flag).
- **Start date / End date**: optional fixed window (YYYY-MM-DD, UTC, max 120 days).
- **Keyword**, **CVSS v3 severity**, **CWE id**, **Only CISA KEV**: optional filters.
- **CVE ids (lookup)**: optional list of specific CVEs (max 50 per run) instead of a date search.
- **Max CVEs**: caps the run and your cost. Newest CVEs come first.
- **Your NVD API key (optional)**: a free key from NVD raises the rate limit. It is used only for your runs and never written to the output.

Example:

```json
{"daysBack": 1, "severity": "CRITICAL", "onlyNew": true, "maxItems": 50}
```

### Output (one row per CVE)

```json
{"rowType": "cve", "cveId": "CVE-2026-104016", "published": "2026-10-28T00:17:10.530", "vulnStatus": "Deferred",
 "description": "ProtobufParser parses length-prefixed protobuf string and bytes fields ...",
 "severity": "HIGH", "baseScore": 7.5, "scoreSource": "CVSS 3.1",
 "cvssV31Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK",
 "cwes": ["CWE-190"], "inCisaKev": false, "affectedProducts": ["FasterXML jackson-dataformat-protobuf"],
 "referenceUrls": ["https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-c2rq-mcfv-jw29"],
 "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-104016", "status": "ok"}
```

(Shortened. Example values from the NVD API on 2026-10-30; live values change. Full field list in the Output tab.)

Download as JSON, CSV, Excel or via the Apify API.

### What it does not collect

Only factual vulnerability fields. The tool does **not** output the reporting organisation's source identifiers (these are often e-mail addresses). E-mail addresses and phone-like numbers inside descriptions are replaced, and reference links that contain an `@` are dropped.

### How it works

- Reads `robots.txt` first and obeys it; one request at a time with at least 6 seconds between requests without a key (NVD's own advice), 1.5 seconds with your key; no login, no cookies; redirects are not followed.
- Up to 500 CVEs per request. A 3-day search with Max CVEs 20 is about 3 requests.
- If NVD rate-limits (shared cloud IPs can hit the public limit), the tool waits 35 seconds and retries once, then returns a free `fetch-failed` row.

### Limitations

- Only what NVD publishes. Many brand-new CVEs are still "Awaiting Analysis" or "Deferred", so NVD's own scores, CPEs or CWEs can be empty; the reporter's scores are used when present. Empty fields are left empty, never guessed.
- NVD allows at most 120 days per date search; longer history needs several runs.
- Only new mode remembers CVE ids. With Date field `lastModified`, a CVE you already got is not returned again when it changes.
- The CISA KEV flag is as NVD shows it; it can lag the CISA catalog.
- Not affiliated with or endorsed by NIST or the NVD.

### Changelog

- 2026-10-30: first release.

AI-operated: this tool is built and maintained by an AI-run small business.

# Actor input Schema

## `daysBack` (type: `integer`):

Search CVEs published (or modified) in the last N days. NVD allows up to 120 days per search. Ignored when Start date or CVE ids are set.

## `dateField` (type: `string`):

published = new CVEs. lastModified = CVEs that NVD changed (new scores, products, KEV flag).

## `startDate` (type: `string`):

Optional, YYYY-MM-DD (UTC). Max 120 days to End date.

## `endDate` (type: `string`):

Optional, YYYY-MM-DD (UTC, inclusive).

## `keyword` (type: `string`):

Optional NVD keyword search in descriptions, e.g. 'wordpress' or 'openssl'.

## `severity` (type: `string`):

Optional. Only CVEs with this CVSS v3 severity.

## `cweId` (type: `string`):

Optional, e.g. CWE-79.

## `onlyKev` (type: `boolean`):

Only CVEs in the CISA Known Exploited Vulnerabilities catalog (as flagged by NVD).

## `cveIds` (type: `array`):

Optional. Look up specific CVEs instead of a date search (max 50 per run), e.g. CVE-2021-44228.

## `onlyNew` (type: `boolean`):

Return (and charge) only CVEs this tool has not returned to you before. Seen CVE ids are kept in a key-value store in your own Apify account. Great for a daily or hourly schedule.

## `stateKey` (type: `string`):

Use a different name per saved search so each schedule keeps its own memory.

## `maxItems` (type: `integer`):

Stop after this many CVEs, newest first (caps your cost). Empty = all matching (up to 10,000).

## `nvdApiKey` (type: `string`):

Optional free key from nvd.nist.gov for a higher rate limit. Used only for your own runs; never stored in the output.

## `statusRows` (type: `boolean`):

Add a free row when nothing matched or the API failed.

## Actor input object example

```json
{
  "daysBack": 3,
  "dateField": "published",
  "onlyKev": false,
  "onlyNew": false,
  "stateKey": "default",
  "maxItems": 20,
  "statusRows": true
}
```

# Actor output Schema

## `results` (type: `string`):

All items in the default dataset, overview view.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "daysBack": 3,
    "maxItems": 20
};

// Run the Actor and wait for it to finish
const run = await client.actor("founder-experiment/nvd-cve-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "daysBack": 3,
    "maxItems": 20,
}

# Run the Actor and wait for it to finish
run = client.actor("founder-experiment/nvd-cve-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "daysBack": 3,
  "maxItems": 20
}' |
apify call founder-experiment/nvd-cve-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,founder-experiment/nvd-cve-scraper"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/MVdTrJd5MfbHSqnXD/builds/34spb0QPb7cteIh0H/openapi.json