# CVE Scraper: NVD Vulnerabilities & Dependency Audit (`glitchbound/cve-scraper`) Actor

Look up any CVE from NIST's National Vulnerability Database with CVSS score, CWE type and affected vendors, or audit your dependencies against Google's OSV to see which advisories hit the exact versions you run, each with the version that fixes it. npm, PyPI, Go, Maven, crates.io. No API key.

- **URL**: https://apify.com/glitchbound/cve-scraper.md
- **Developed by:** [Daniel Meshulam](https://apify.com/glitchbound) (community)
- **Categories:** Developer tools, AI, Other
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.50 / 1,000 vulnerability records

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## CVE Scraper: NVD Vulnerabilities & Dependency Audit

Two questions, two official sources, one table.

**"What is this CVE?"** Any CVE from NIST's National Vulnerability Database,
with the CVSS score and vector, the CWE weakness type, the affected vendors and
products, and every vendor reference.

**"Is anything in my dependencies exploitable?"** Your packages checked against
Google's OSV database, version-aware, with the version that fixes each finding.

No API key for either.

### Audit what you actually run, not what exists

The difference a version makes, measured on `lodash`:

```
npm:lodash            10 advisories ever filed
npm:lodash@4.17.20     5 advisories that affect THAT version
```

Pin the version and half the noise disappears, and what is left is real. Every
row carries `fixedVersions`, which is the only field that turns an advisory into
a ticket:

| advisory | CVE | fixed in |
|---|---|---|
| `GHSA-29mw-wpgm-hmr9` | CVE-2020-28500 | `4.17.21` |
| `GHSA-35jh-r3h4-6jhm` | CVE-2021-23337 | `4.17.21` |
| `GHSA-f23m-r3pf-42rh` | CVE-2025-13465 | `4.18.0` |

**Ecosystems**: `npm`, `pypi`, `go`, `maven`, `crates`, `rubygems`, `nuget`,
`packagist`, `hex`, `pub`, `conan`, `linux`. Write them as
`ecosystem:name@version`; a bare name defaults to npm.

```json
{
  "packages": [
    "npm:lodash@4.17.20",
    "pypi:django@3.2.0",
    "go:github.com/gin-gonic/gin",
    "maven:org.apache.logging.log4j:log4j-core@2.14.1"
  ]
}
```

### Look up CVEs

```json
{ "cveIds": ["CVE-2021-44228"] }
```

```
CVE-2021-44228   CVSS 10.0 CRITICAL (v3.1)
CWE-20, CWE-400, CWE-502, CWE-917
vendors: apache, apple, bentley, cisco, debian, …
```

**The vendor and product list is the tedious part of using NVD directly.** It is
not a field: it is buried in CPE match strings inside nested configuration
nodes, and every consumer has to unpick it. Here it is `vendors` and `products`.

**CVSS version is reported, not assumed.** NVD carries v4, v3.1, v3.0 and v2
side by side depending on when a CVE was scored. The newest available is used
and `cvssVersion` says which, so a v2-only score from 1999 is never silently
compared against a v3.1 one.

### Search and monitor

| You want | Input |
|---|---|
| Everything critical this month | `severities: ["CRITICAL"]` + `publishedSince` |
| Anything mentioning a product | `keywords: ["log4j"]` |
| A weekly feed of what is new | `publishedSince` + a Schedule |
| Only what matters | `minCvssScore: 7` |

`minCvssScore` is applied after fetch because NVD has no such parameter, and the
rows it drops are **not charged**.

### The 120-day window, and why a 404 here is a trap

NVD accepts a publication window of at most **120 days**. Ask for 131 and it
answers **404**, which every naive client reads as "no vulnerabilities found".

Measured: 120 days returns 22,140 results, 130 days returns 404. Same for page
size, where 2000 works and 2001 is a 404.

Both limits are enforced **before** the request, so a window that is too wide
comes back as an explanation rather than as a confident, silent zero.

### What you get

| Field | |
|---|---|
| `cveId` | `CVE-2021-44228` |
| `cvssScore`, `cvssSeverity`, `cvssVersion`, `cvssVector` | `10.0`, `CRITICAL`, `3.1`, the full vector |
| `cweIds` | `["CWE-20", "CWE-400", "CWE-502", "CWE-917"]` |
| `vendors`, `products` | unpicked from the CPE configuration tree |
| `published`, `lastModified`, `status` | |
| `references`, `referenceCount` | vendor advisories and patches |
| `fixedVersions` | on package rows, the version that resolves it |
| `advisoryId`, `aliases` | `GHSA-…` and every CVE it maps to |

### Who this is for

- **Security teams**: a scheduled feed of new CRITICAL CVEs affecting your stack
- **Developers**: audit a lockfile's worth of dependencies and get fix versions
- **Compliance**: an auditable record of what was known, and when
- **Threat intelligence**: keyword and vendor monitoring across the full NIST record
- **LLM pipelines**: clean JSON, no HTML parsing, no key to rotate

### Notes

- **NVD rate-limits to 5 requests per 30 seconds without an API key**, and a 403 for exceeding it persists rather than clearing on the next attempt. This Actor paces below that limit rather than discovering it, which is why a large date sweep takes minutes rather than seconds. Correctness over speed.
- Requests use the maximum 2,000 rows per page, because round trips are the scarce resource here, not bandwidth.
- OSV covers open-source packages. A CVE in commercial software will be in NVD and not in OSV, which is why both are here rather than one.
- A CVE id that does not exist, or a package with no advisories, comes back as an `error` row or simply nothing, and neither is charged.
- Both sources are official, public, and free. NIST and Google publish them deliberately.

# Actor input Schema

## `cveIds` (type: `array`):

Specific CVEs to look up, one per line, e.g. CVE-2021-44228. Returns the full NIST record: CVSS score and vector, CWE weakness types, affected vendors and products, and vendor references.

## `packages` (type: `array`):

Dependencies to check against Google's OSV database, one per line. Use ecosystem:name, and add @version to see only what affects the version you actually run: npm:lodash@4.17.20, pypi:django@3.2.0, go:github.com/gin-gonic/gin, maven:org.apache.logging.log4j:log4j-core@2.14.1. A bare name defaults to npm. Every advisory carries the version that fixes it.

## `keywords` (type: `array`):

Free-text search across NVD, one per line, e.g. log4j or "remote code execution". Searches the description text of every CVE.

## `severities` (type: `array`):

Only CVEs at these CVSS v3 severities. Combine with a date window to get, for example, everything CRITICAL published this month.

## `publishedSince` (type: `string`):

Only CVEs published on or after this date, e.g. 2026-07-01. NVD accepts a window of at most 120 days and answers 404 for anything wider, which reads as "no results", so a longer range is refused here with an explanation rather than sent.

## `publishedUntil` (type: `string`):

End of the window, e.g. 2026-07-31. Defaults to today.

## `minCvssScore` (type: `integer`):

Drop anything scored below this, 0 to 10. NVD has no such parameter, so this is applied after fetch and the dropped rows are not charged.

## `maxResultsPerQuery` (type: `integer`):

Ceiling per CVE, keyword, severity or package.

## `maxItems` (type: `integer`):

A hard ceiling on rows for the entire run, across every query. The per-query limit above caps each one separately, so fifty queries at a hundred each is still five thousand rows; this caps the total. The run stops cleanly when it is reached and nothing beyond that point is fetched or charged. Leave empty for no ceiling.

## `proxyConfiguration` (type: `object`):

Proxy settings. Both sources are official and neither blocks datacenter addresses, so the default is fine. NVD does rate-limit to 5 requests per 30 seconds without an API key, which this Actor paces for rather than retries into.

## Actor input object example

```json
{
  "cveIds": [
    "CVE-2021-44228"
  ],
  "maxResultsPerQuery": 100,
  "proxyConfiguration": {
    "useApifyProxy": true
  }
}
```

# Actor output Schema

## `results` (type: `string`):

CVE id, CVSS score and severity, CWE type, affected vendors and products; or for a dependency audit, the package, the version you run, the advisory and the version that fixes it.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "cveIds": [
        "CVE-2021-44228"
    ],
    "maxResultsPerQuery": 100
};

// Run the Actor and wait for it to finish
const run = await client.actor("glitchbound/cve-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "cveIds": ["CVE-2021-44228"],
    "maxResultsPerQuery": 100,
}

# Run the Actor and wait for it to finish
run = client.actor("glitchbound/cve-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "cveIds": [
    "CVE-2021-44228"
  ],
  "maxResultsPerQuery": 100
}' |
apify call glitchbound/cve-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=glitchbound/cve-scraper",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/H0iUIdKIsyeGr8oky/builds/vncM1qmbQmu5Sry70/openapi.json