CVE Vulnerability Tracker — NVD, CVSS, Product Search

What does CVE Vulnerability Tracker do?

CVE Vulnerability Tracker is a security vulnerability monitor that queries the NIST National Vulnerability Database (NVD) — the authoritative US government CVE enrichment database — to return structured CVE records with CVSS v3/v2 scores, CWE weakness classifications, affected product lists, and external references. Filter by product keyword, CPE name, severity level, and publication date range. No API key is required to get started; add a free NVD API key for 10x higher throughput on large batches.

Why use CVE Vulnerability Tracker?

Authoritative CVE data at $0.001 per record — the same NIST NVD source that enterprise scanners use, without the enterprise price tag:

• Security team patch prioritization — pull CRITICAL and HIGH CVEs for your entire software stack in one run, ranked by CVSS score, so engineers focus remediation effort where it matters most.
• Vendor and third-party risk assessment — query CVEs by vendor keyword before procurement or contract decisions to quantify the security track record of software dependencies.
• Automated vulnerability alerting — schedule daily runs filtered to your tech stack keywords and new pubStartDate windows; pipe results to Slack, PagerDuty, or a SIEM for zero-lag NVD CVE database API coverage.
• Compliance and audit reporting — generate CVE reports mapped to CVSS severity tiers for SOC 2, ISO 27001, PCI-DSS, or NIST 800-53 audit evidence packages.
• Threat intelligence enrichment — augment asset inventories, CMDB records, and SBOMs with known vulnerability data directly from the CVE program source.

Cost comparison:

Tool	Annual Cost	Data Source
This actor	$0.001/CVE	NIST NVD (free, authoritative)
Tenable.io	$5,000+/year	NIST NVD + proprietary
Qualys VMDR	$10,000+/year	NIST NVD + proprietary
Rapid7 InsightVM	$8,000+/year	NIST NVD + proprietary

How to use CVE Vulnerability Tracker

1. Open the actor on Apify — it works immediately with no API key.
2. Enter a keywordSearch term (e.g. "Apache Log4j", "Microsoft Exchange", "openssl") or a cpeName for precise CPE-based filtering.
3. Optionally set severity to ["CRITICAL", "HIGH"] to focus on high-risk findings.
4. Set pubStartDate and pubEndDate for a rolling date window (e.g. last 30 days).
5. (Optional) Add a free NVD API key in nvdApiKey — get one at nvd.nist.gov/developers/request-an-api-key in under 2 minutes.
6. Click Run — CVE records appear in the dataset. A summary record with severity breakdown is also pushed to the KVS.

Input

Field	Type	Required	Description
keywordSearch	string	No	Product or vendor keyword (e.g. Apache Log4j, Microsoft Exchange)
cpeName	string	No	CPE 2.3 name for precise product filtering (e.g. cpe:2.3:a:apache:log4j)
severity	array	No	CVSS v3 severity filter: CRITICAL, HIGH, MEDIUM, LOW
pubStartDate	string	No	Published after date (YYYY-MM-DD)
pubEndDate	string	No	Published before date (YYYY-MM-DD)
nvdApiKey	string	No	Free NVD API key for 10x higher rate limits
maxResults	integer	No	Maximum CVEs to return (default: 200, max: 2000)

Tips:

• Use keywordSearch for quick discovery: "openssl", "log4j", "Exchange Server"
• Combine pubStartDate + pubEndDate for a rolling 30-day window to catch newly published CVEs
• Set severity: ["CRITICAL"] to focus on the highest-risk findings first

Output

Each CVE is returned as a structured JSON record, plus a summary in the Key-Value Store:

[
  {
    "cve_id": "CVE-2021-44228",
    "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
    "published_date": "2021-12-10T10:15:09.143",
    "last_modified": "2023-04-03T19:15:00.000",
    "cvss_v3_score": 10.0,
    "cvss_v3_severity": "CRITICAL",
    "cvss_v3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
    "cvss_v2_score": 9.3,
    "cwe_ids": ["CWE-502", "CWE-400", "CWE-20"],
    "affected_products": [
      "cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*"
    ],
    "references": [
      "https://logging.apache.org/log4j/2.x/security.html",
      "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
    ],
    "exploitability_score": 3.9,
    "impact_score": 6.0
  }
]

KVS Summary record (pushed to SUMMARY key):

{
  "total_cves": 47,
  "by_severity": {
    "CRITICAL": 12,
    "HIGH": 23,
    "MEDIUM": 10,
    "UNKNOWN": 2
  },
  "top_5_critical": [
    {"cve_id": "CVE-2021-44228", "cvss_v3_score": 10.0, "cvss_v3_severity": "CRITICAL"},
    {"cve_id": "CVE-2022-0778",  "cvss_v3_score": 9.8,  "cvss_v3_severity": "CRITICAL"}
  ]
}

Data fields

Field	Description
cve_id	CVE identifier (e.g. CVE-2021-44228)
description	Full NVD vulnerability description
published_date	ISO 8601 timestamp of CVE publication
last_modified	ISO 8601 timestamp of last NVD record update
cvss_v3_score	CVSS v3 base score (0.0–10.0)
cvss_v3_severity	CVSS v3 severity label: LOW, MEDIUM, HIGH, or CRITICAL
cvss_v3_vector	Full CVSS v3 vector string
cvss_v2_score	CVSS v2 base score (legacy, 0.0–10.0)
cwe_ids	List of CWE weakness classification IDs
affected_products	List of CPE 2.3 strings for affected product versions
references	List of external reference URLs (vendor advisories, PoCs, patches)
exploitability_score	CVSS exploitability sub-score
impact_score	CVSS impact sub-score

Cost estimation

Scenario	CVEs returned	Estimated Cost
Single product keyword, 30-day window	10–50	$0.01–$0.05
Full stack audit (5 keywords), CRITICAL only	50–200	$0.05–$0.20
Monthly CVE digest, all severities	200	~$0.20
Annual bulk pull (maxResults 2000)	2,000	~$2.00

Pricing: $0.001 per run start + $0.001 per CVE returned.

Without an NVD API key, the actor sleeps 6 seconds between pages (NVD's 5 req/30s limit). With a free key, it sleeps 0.6 seconds — approximately 10x faster for large batches.

FAQ

Do I need an NVD API key to use this actor? No — the actor works immediately without any API key. Without a key, NVD enforces a lower rate limit (5 requests per 30 seconds), which slows down large queries. A free key is available in under 2 minutes at nvd.nist.gov/developers/request-an-api-key and unlocks 10x faster throughput with no usage quota beyond rate limits.

How do I monitor for new CVEs affecting my stack automatically? Use the Apify Scheduler to run this actor daily with pubStartDate set to yesterday's date and keywordSearch covering your tech stack components. Connect the output to a webhook, Slack integration, or email notification via Apify integrations to receive zero-lag security vulnerability monitor alerts.

Is the CVE data the same as what commercial scanners provide? For raw CVE records — yes. Tenable, Qualys, and Rapid7 all source their CVE data from the same NIST NVD API this actor uses. Commercial scanners add value through authenticated host scanning, plugin-based detection, and asset management. This actor is best suited for CVE research, alerting pipelines, and compliance reporting where you already know your asset inventory.

---

Disclaimer: This actor retrieves publicly available data from the NIST National Vulnerability Database (NVD) provided by the US government in the public domain. It is not affiliated with NIST, MITRE, or the CVE Program. CVE data should be validated against your specific software versions and deployment configurations before use in security decisions. This actor does not perform authenticated scanning or detect whether vulnerabilities are exploitable in your environment.

Keywords: CVE vulnerability tracker, security vulnerability monitor, NVD CVE database API, NIST NVD, CVSS score, cybersecurity, patch management, CWE, CPE, vulnerability scanner, exploit database, security advisory

---

Related actors

• SSL Certificate Monitor — TLS certificate expiry and chain issues that often accompany CVE-related infrastructure risks
• Domain Breach Checker — HIBP breach data for organizations with known CVE exposures
• Shodan Surface Mapper — External attack surface enumeration to identify systems affected by tracked CVEs

Feedback

If this actor powers your security research, a review helps others find it: Leave a review on Apify Store