CVE Lookup – NVD CVSS, CISA KEV & EPSS Vulnerability API

Look up, search and monitor CVE vulnerabilities with the three sources security teams actually prioritise by, merged into one row per CVE:

• NVD: CVSS 4.0 / 3.1 / 2.0 score, severity and vector, CWE weaknesses, affected vendors, products and version ranges (CPE), references.
• CISA KEV: whether the CVE is a Known Exploited Vulnerability, the date added, the federal due date, ransomware use and the required action.
• EPSS (FIRST.org): the probability of exploitation in the next 30 days and its percentile.

No API key required. $0.80 per 1,000 CVE records. Not-found and invalid IDs are free.

What it does

• CVE ID lookup: paste a list of CVE IDs (from a scanner, SBOM or ticket) and get the full picture for each.
• Keyword / vendor / product search: e.g. fortinet, apache struts, wordpress plugin, optionally limited to CVEs published in the last N days.
• CPE search: exact product versions (cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*) or partial match strings.
• New and changed CVEs: everything published or modified in the last N days (date windows are split automatically to fit NVD's 120-day limit).
• New KEV entries: CVEs added to the CISA KEV catalog in the last N days, with NVD details.
• Filters: severity, minimum CVSS, minimum EPSS, only KEV.
• Monitoring mode: onlyNew remembers what earlier runs returned, so a daily schedule gives you only new CVEs (repeats are free).
• Exploit references (links NVD tags as "Exploit") are always included; all references are optional.
• Works without an NVD key (5 requests per 30 s). Add your free NVD API key for about 9x faster CVE-ID lists.

Use cases

• Vulnerability management: enrich scanner output (Nessus, Qualys, Trivy, Grype) with KEV and EPSS to decide what to patch first.
• Daily threat feed: schedule "published in the last 1 day, CRITICAL or KEV" for your vendors and send it to Slack or email with an Apify integration.
• Vendor risk / due diligence: list a vendor's CVEs with severity and exploitation status.
• Security dashboards and AI agents that need structured CVE data.

Input examples

{ "cveIds": ["CVE-2021-44228", "CVE-2024-3400"] }

{ "keywords": ["fortinet", "ivanti"], "publishedLastDays": 7, "severities": ["CRITICAL", "HIGH"], "onlyNew": true }

{ "kevAddedLastDays": 7 }

Output example

{
  "cveId": "CVE-2024-3400", "published": "2024-04-12T08:15:06.230", "status": "Analyzed",
  "description": "A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS…",
  "cvssScore": 10.0, "severity": "CRITICAL", "cvssVersion": "3.1", "cvssV31Score": 10.0,
  "cwe": ["CWE-20", "CWE-77"],
  "inCisaKev": true, "kevDateAdded": "2024-04-12", "kevDueDate": "2024-04-19", "kevRansomwareUse": "Unknown",
  "epss": 0.99999, "epssPercentile": 1.0,
  "vendors": ["paloaltonetworks"], "products": ["pan-os"],
  "affectedCpes": [{"vendor": "paloaltonetworks", "product": "pan-os", "version": "10.2.0", "cpe": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:-:*:*:*:*:*:*"}],
  "exploitReferenceCount": 4, "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3400"
}

Pricing (pay per event)

Event	Price
CVE record (NVD + KEV + EPSS merged)	$0.0008
Actor start	$0.00005

Filtered-out CVEs, repeats in monitoring mode, invalid and not-found IDs are free. Set a maximum cost per run and the Actor stops cleanly at that limit.

FAQ

Why is a CVE-ID list slow? Without a key NVD allows 5 requests per 30 seconds, so each CVE ID takes about 6 seconds. Searches return up to 2,000 CVEs per request and are fast. A free NVD API key makes ID lookups about 9x faster.

Which CVSS score is cvssScore? CVSS 4.0 when NVD has it, otherwise 3.1, 3.0, then 2.0. The 3.1 and 4.0 scores are also returned separately.

How fresh is the data? Every run queries NVD, the CISA KEV catalog and EPSS live (EPSS updates daily).

Data sources and attribution

This product uses the NVD API but is not endorsed or certified by the NVD. KEV data: CISA Known Exploited Vulnerabilities Catalog (public domain). EPSS: FIRST.org, Exploit Prediction Scoring System (https://www.first.org/epss).

Use with AI agents (Apify MCP)

Works as a tool in the Apify MCP server: "Which of these 20 CVEs are actively exploited and should be patched first?"