# CVE Lookup – NVD CVSS, CISA KEV & EPSS Vulnerability API (`gazidev/cve-vulnerability-lookup`) Actor

Look up and monitor CVEs: CVSS 3.1/4.0 score and vector, CWE, affected vendors/products (CPE), CISA Known Exploited (KEV) status, EPSS exploit probability and exploit references in one row. Search by keyword, product or date. $0.80 per 1,000 CVEs.

- **URL**: https://apify.com/gazidev/cve-vulnerability-lookup.md
- **Developed by:** [Cemal Atakli](https://apify.com/gazidev) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.80 / 1,000 cve records

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CVE Lookup – NVD CVSS, CISA KEV & EPSS Vulnerability API

Look up, search and monitor **CVE vulnerabilities** with the three sources security teams actually prioritise by, merged into **one row per CVE**:

- **NVD:** CVSS 4.0 / 3.1 / 2.0 score, severity and vector, CWE weaknesses, affected vendors, products and version ranges (CPE), references.
- **CISA KEV:** whether the CVE is a **Known Exploited Vulnerability**, the date added, the federal due date, ransomware use and the required action.
- **EPSS (FIRST.org):** the **probability of exploitation in the next 30 days** and its percentile.

No API key required. **$0.80 per 1,000 CVE records.** Not-found and invalid IDs are free.

### What it does

- **CVE ID lookup:** paste a list of CVE IDs (from a scanner, SBOM or ticket) and get the full picture for each.
- **Keyword / vendor / product search:** e.g. `fortinet`, `apache struts`, `wordpress plugin`, optionally limited to **CVEs published in the last N days**.
- **CPE search:** exact product versions (`cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*`) or partial match strings.
- **New and changed CVEs:** everything **published** or **modified** in the last N days (date windows are split automatically to fit NVD's 120-day limit).
- **New KEV entries:** CVEs added to the CISA KEV catalog in the last N days, with NVD details.
- **Filters:** severity, minimum CVSS, minimum EPSS, **only KEV**.
- **Monitoring mode:** `onlyNew` remembers what earlier runs returned, so a daily schedule gives you only new CVEs (repeats are free).
- **Exploit references** (links NVD tags as "Exploit") are always included; all references are optional.
- Works without an NVD key (5 requests per 30 s). Add your **free NVD API key** for about 9x faster CVE-ID lists.

### Use cases

- **Vulnerability management:** enrich scanner output (Nessus, Qualys, Trivy, Grype) with KEV and EPSS to decide what to patch first.
- **Daily threat feed:** schedule "published in the last 1 day, CRITICAL or KEV" for your vendors and send it to Slack or email with an Apify integration.
- **Vendor risk / due diligence:** list a vendor's CVEs with severity and exploitation status.
- **Security dashboards and AI agents** that need structured CVE data.

### Input examples

```json
{ "cveIds": ["CVE-2021-44228", "CVE-2024-3400"] }
```

```json
{ "keywords": ["fortinet", "ivanti"], "publishedLastDays": 7, "severities": ["CRITICAL", "HIGH"], "onlyNew": true }
```

```json
{ "kevAddedLastDays": 7 }
```

### Output example

```json
{
  "cveId": "CVE-2024-3400", "published": "2024-04-12T08:15:06.230", "status": "Analyzed",
  "description": "A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS…",
  "cvssScore": 10.0, "severity": "CRITICAL", "cvssVersion": "3.1", "cvssV31Score": 10.0,
  "cwe": ["CWE-20", "CWE-77"],
  "inCisaKev": true, "kevDateAdded": "2024-04-12", "kevDueDate": "2024-04-19", "kevRansomwareUse": "Unknown",
  "epss": 0.99999, "epssPercentile": 1.0,
  "vendors": ["paloaltonetworks"], "products": ["pan-os"],
  "affectedCpes": [{"vendor": "paloaltonetworks", "product": "pan-os", "version": "10.2.0", "cpe": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:-:*:*:*:*:*:*"}],
  "exploitReferenceCount": 4, "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3400"
}
```

### Pricing (pay per event)

| Event | Price |
|---|---|
| CVE record (NVD + KEV + EPSS merged) | **$0.0008** |
| Actor start | $0.00005 |

Filtered-out CVEs, repeats in monitoring mode, invalid and not-found IDs are **free**. Set a *maximum cost per run* and the Actor stops cleanly at that limit.

### FAQ

**Why is a CVE-ID list slow?** Without a key NVD allows 5 requests per 30 seconds, so each CVE ID takes about 6 seconds. Searches return up to 2,000 CVEs per request and are fast. A free NVD API key makes ID lookups about 9x faster.

**Which CVSS score is `cvssScore`?** CVSS 4.0 when NVD has it, otherwise 3.1, 3.0, then 2.0. The 3.1 and 4.0 scores are also returned separately.

**How fresh is the data?** Every run queries NVD, the CISA KEV catalog and EPSS live (EPSS updates daily).

### Data sources and attribution

This product uses the NVD API but is not endorsed or certified by the NVD. KEV data: CISA Known Exploited Vulnerabilities Catalog (public domain). EPSS: FIRST.org, Exploit Prediction Scoring System (https://www.first.org/epss).

### Use with AI agents (Apify MCP)

Works as a tool in the [Apify MCP server](https://mcp.apify.com): "Which of these 20 CVEs are actively exploited and should be patched first?"

# Actor input Schema

## `cveIds` (type: `array`):

Look up specific CVEs, e.g. CVE-2021-44228.

## `keywords` (type: `array`):

Search NVD descriptions, e.g. 'fortinet', 'apache struts', 'wordpress plugin'. Combine with 'Published in the last N days' to get only new CVEs.

## `cpeNames` (type: `array`):

Exact products and versions, e.g. cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:\* or a partial match string like cpe:2.3:a:microsoft:exchange_server.

## `publishedLastDays` (type: `integer`):

Only CVEs published recently. Alone (without keywords) it returns every new CVE in that period.

## `modifiedLastDays` (type: `integer`):

CVEs whose NVD record changed recently (new scores, new references, KEV additions).

## `kevAddedLastDays` (type: `integer`):

Newly confirmed actively exploited vulnerabilities from the CISA catalog.

## `kevWithNvdDetails` (type: `boolean`):

Fetch CVSS, CWE and CPE from NVD for each KEV entry (slower without an NVD API key).

## `severities` (type: `array`):

Keep only these severities (CVSS 4.0, else 3.x, else 2.0).

## `minCvss` (type: `string`):

e.g. 7.0. Leave empty for all.

## `minEpss` (type: `string`):

0 to 1, e.g. 0.1 = at least 10% probability of exploitation in the next 30 days.

## `onlyKev` (type: `boolean`):

Keep only CVEs in the CISA Known Exploited Vulnerabilities catalog.

## `maxResultsPerQuery` (type: `integer`):

Per keyword, CPE or date search. 0 = no limit.

## `includeAffectedCpes` (type: `boolean`):

Vulnerable vendor/product/version ranges (up to 60 per CVE).

## `includeReferences` (type: `boolean`):

Advisories, patches and exploit links with their NVD tags (exploit links are always included).

## `onlyNew` (type: `boolean`):

For scheduled monitoring: skip CVEs that earlier runs with the same state key already returned (free).

## `stateKey` (type: `string`):

Separate monitors keep separate 'seen' lists.

## `nvdApiKey` (type: `string`):

Free from nvd.nist.gov/developers/request-an-api-key. Raises the NVD limit from 5 to 50 requests per 30 s (about 9x faster for CVE-ID lists). Not required.

## Actor input object example

```json
{
  "cveIds": [
    "CVE-2021-44228",
    "CVE-2024-3400"
  ],
  "publishedLastDays": 0,
  "modifiedLastDays": 0,
  "kevAddedLastDays": 0,
  "kevWithNvdDetails": true,
  "onlyKev": false,
  "maxResultsPerQuery": 200,
  "includeAffectedCpes": true,
  "includeReferences": false,
  "onlyNew": false,
  "stateKey": "default"
}
```

# Actor output Schema

## `cves` (type: `string`):

No description

## `results` (type: `string`):

No description

## `summary` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "cveIds": [
        "CVE-2021-44228",
        "CVE-2024-3400"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("gazidev/cve-vulnerability-lookup").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "cveIds": [
        "CVE-2021-44228",
        "CVE-2024-3400",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("gazidev/cve-vulnerability-lookup").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "cveIds": [
    "CVE-2021-44228",
    "CVE-2024-3400"
  ]
}' |
apify call gazidev/cve-vulnerability-lookup --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,gazidev/cve-vulnerability-lookup"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Ncm7qjZr3fFP44RwB/builds/ze853lu6HIsiAUJbd/openapi.json