CVE Scraper: NVD Vulnerabilities & Dependency Audit

Two questions, two official sources, one table.

"What is this CVE?" Any CVE from NIST's National Vulnerability Database, with the CVSS score and vector, the CWE weakness type, the affected vendors and products, and every vendor reference.

"Is anything in my dependencies exploitable?" Your packages checked against Google's OSV database, version-aware, with the version that fixes each finding.

No API key for either.

Audit what you actually run, not what exists

The difference a version makes, measured on lodash:

npm:lodash            10 advisories ever filed
npm:lodash@4.17.20     5 advisories that affect THAT version

Pin the version and half the noise disappears, and what is left is real. Every row carries fixedVersions, which is the only field that turns an advisory into a ticket:

advisory	CVE	fixed in
GHSA-29mw-wpgm-hmr9	CVE-2020-28500	4.17.21
GHSA-35jh-r3h4-6jhm	CVE-2021-23337	4.17.21
GHSA-f23m-r3pf-42rh	CVE-2025-13465	4.18.0

Ecosystems: npm, pypi, go, maven, crates, rubygems, nuget, packagist, hex, pub, conan, linux. Write them as ecosystem:name@version; a bare name defaults to npm.

{
  "packages": [
    "npm:lodash@4.17.20",
    "pypi:django@3.2.0",
    "go:github.com/gin-gonic/gin",
    "maven:org.apache.logging.log4j:log4j-core@2.14.1"
  ]
}

Look up CVEs

{ "cveIds": ["CVE-2021-44228"] }

CVE-2021-44228   CVSS 10.0 CRITICAL (v3.1)
CWE-20, CWE-400, CWE-502, CWE-917
vendors: apache, apple, bentley, cisco, debian, …

The vendor and product list is the tedious part of using NVD directly. It is not a field: it is buried in CPE match strings inside nested configuration nodes, and every consumer has to unpick it. Here it is vendors and products.

CVSS version is reported, not assumed. NVD carries v4, v3.1, v3.0 and v2 side by side depending on when a CVE was scored. The newest available is used and cvssVersion says which, so a v2-only score from 1999 is never silently compared against a v3.1 one.

Search and monitor

You want	Input
Everything critical this month	severities: ["CRITICAL"] + publishedSince
Anything mentioning a product	keywords: ["log4j"]
A weekly feed of what is new	publishedSince + a Schedule
Only what matters	minCvssScore: 7

minCvssScore is applied after fetch because NVD has no such parameter, and the rows it drops are not charged.

The 120-day window, and why a 404 here is a trap

NVD accepts a publication window of at most 120 days. Ask for 131 and it answers 404, which every naive client reads as "no vulnerabilities found".

Measured: 120 days returns 22,140 results, 130 days returns 404. Same for page size, where 2000 works and 2001 is a 404.

Both limits are enforced before the request, so a window that is too wide comes back as an explanation rather than as a confident, silent zero.

What you get

Field
cveId	CVE-2021-44228
cvssScore, cvssSeverity, cvssVersion, cvssVector	10.0, CRITICAL, 3.1, the full vector
cweIds	["CWE-20", "CWE-400", "CWE-502", "CWE-917"]
vendors, products	unpicked from the CPE configuration tree
published, lastModified, status
references, referenceCount	vendor advisories and patches
fixedVersions	on package rows, the version that resolves it
advisoryId, aliases	GHSA-… and every CVE it maps to

Who this is for

• Security teams: a scheduled feed of new CRITICAL CVEs affecting your stack
• Developers: audit a lockfile's worth of dependencies and get fix versions
• Compliance: an auditable record of what was known, and when
• Threat intelligence: keyword and vendor monitoring across the full NIST record
• LLM pipelines: clean JSON, no HTML parsing, no key to rotate

Notes

• NVD rate-limits to 5 requests per 30 seconds without an API key, and a 403 for exceeding it persists rather than clearing on the next attempt. This Actor paces below that limit rather than discovering it, which is why a large date sweep takes minutes rather than seconds. Correctness over speed.
• Requests use the maximum 2,000 rows per page, because round trips are the scarce resource here, not bandwidth.
• OSV covers open-source packages. A CVE in commercial software will be in NVD and not in OSV, which is why both are here rather than one.
• A CVE id that does not exist, or a package with no advisories, comes back as an error row or simply nothing, and neither is charged.
• Both sources are official, public, and free. NIST and Google publish them deliberately.