# CVE Vulnerability Tracker — NVD, CVSS, Product Search (`gochujang/cve-vulnerability-tracker`) Actor

Track CVEs from NIST NVD. Search by product/vendor keyword, CPE name, severity (CRITICAL/HIGH/MEDIUM/LOW), date range. Returns CVSS scores, affected versions, references, and CWE types. No API key required.

- **URL**: https://apify.com/gochujang/cve-vulnerability-tracker.md
- **Developed by:** [Hojun Lee](https://apify.com/gochujang) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per usage

This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-usage

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

### What does CVE Vulnerability Tracker do?

**CVE Vulnerability Tracker** is a **security vulnerability monitor** that queries the **NIST National Vulnerability Database (NVD)** — the authoritative US government CVE enrichment database — to return structured CVE records with CVSS v3/v2 scores, CWE weakness classifications, affected product lists, and external references. Filter by product keyword, CPE name, severity level, and publication date range. No API key is required to get started; add a free NVD API key for 10x higher throughput on large batches.

### Why use CVE Vulnerability Tracker?

**Authoritative CVE data at $0.001 per record — the same NIST NVD source that enterprise scanners use, without the enterprise price tag:**

- **Security team patch prioritization** — pull `CRITICAL` and `HIGH` CVEs for your entire software stack in one run, ranked by CVSS score, so engineers focus remediation effort where it matters most.
- **Vendor and third-party risk assessment** — query CVEs by vendor keyword before procurement or contract decisions to quantify the security track record of software dependencies.
- **Automated vulnerability alerting** — schedule daily runs filtered to your tech stack keywords and new `pubStartDate` windows; pipe results to Slack, PagerDuty, or a SIEM for zero-lag **NVD CVE database API** coverage.
- **Compliance and audit reporting** — generate CVE reports mapped to CVSS severity tiers for SOC 2, ISO 27001, PCI-DSS, or NIST 800-53 audit evidence packages.
- **Threat intelligence enrichment** — augment asset inventories, CMDB records, and SBOMs with known vulnerability data directly from the CVE program source.

**Cost comparison:**

| Tool | Annual Cost | Data Source |
|------|-------------|-------------|
| **This actor** | $0.001/CVE | NIST NVD (free, authoritative) |
| Tenable.io | $5,000+/year | NIST NVD + proprietary |
| Qualys VMDR | $10,000+/year | NIST NVD + proprietary |
| Rapid7 InsightVM | $8,000+/year | NIST NVD + proprietary |

### How to use CVE Vulnerability Tracker

1. Open the actor on Apify — it works immediately with no API key.
2. Enter a `keywordSearch` term (e.g. `"Apache Log4j"`, `"Microsoft Exchange"`, `"openssl"`) or a `cpeName` for precise CPE-based filtering.
3. Optionally set `severity` to `["CRITICAL", "HIGH"]` to focus on high-risk findings.
4. Set `pubStartDate` and `pubEndDate` for a rolling date window (e.g. last 30 days).
5. *(Optional)* Add a free NVD API key in `nvdApiKey` — get one at [nvd.nist.gov/developers/request-an-api-key](https://nvd.nist.gov/developers/request-an-api-key) in under 2 minutes.
6. Click **Run** — CVE records appear in the dataset. A summary record with severity breakdown is also pushed to the KVS.

### Input

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `keywordSearch` | string | No | Product or vendor keyword (e.g. `Apache Log4j`, `Microsoft Exchange`) |
| `cpeName` | string | No | CPE 2.3 name for precise product filtering (e.g. `cpe:2.3:a:apache:log4j`) |
| `severity` | array | No | CVSS v3 severity filter: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW` |
| `pubStartDate` | string | No | Published after date (`YYYY-MM-DD`) |
| `pubEndDate` | string | No | Published before date (`YYYY-MM-DD`) |
| `nvdApiKey` | string | No | Free NVD API key for 10x higher rate limits |
| `maxResults` | integer | No | Maximum CVEs to return (default: 200, max: 2000) |

**Tips:**

- Use `keywordSearch` for quick discovery: `"openssl"`, `"log4j"`, `"Exchange Server"`
- Combine `pubStartDate` + `pubEndDate` for a rolling 30-day window to catch newly published CVEs
- Set `severity: ["CRITICAL"]` to focus on the highest-risk findings first

### Output

Each CVE is returned as a structured JSON record, plus a summary in the Key-Value Store:

```json
[
  {
    "cve_id": "CVE-2021-44228",
    "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
    "published_date": "2021-12-10T10:15:09.143",
    "last_modified": "2023-04-03T19:15:00.000",
    "cvss_v3_score": 10.0,
    "cvss_v3_severity": "CRITICAL",
    "cvss_v3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
    "cvss_v2_score": 9.3,
    "cwe_ids": ["CWE-502", "CWE-400", "CWE-20"],
    "affected_products": [
      "cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*"
    ],
    "references": [
      "https://logging.apache.org/log4j/2.x/security.html",
      "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
    ],
    "exploitability_score": 3.9,
    "impact_score": 6.0
  }
]
```

**KVS Summary record** (pushed to `SUMMARY` key):

```json
{
  "total_cves": 47,
  "by_severity": {
    "CRITICAL": 12,
    "HIGH": 23,
    "MEDIUM": 10,
    "UNKNOWN": 2
  },
  "top_5_critical": [
    {"cve_id": "CVE-2021-44228", "cvss_v3_score": 10.0, "cvss_v3_severity": "CRITICAL"},
    {"cve_id": "CVE-2022-0778",  "cvss_v3_score": 9.8,  "cvss_v3_severity": "CRITICAL"}
  ]
}
```

### Data fields

| Field | Description |
|-------|-------------|
| `cve_id` | CVE identifier (e.g. `CVE-2021-44228`) |
| `description` | Full NVD vulnerability description |
| `published_date` | ISO 8601 timestamp of CVE publication |
| `last_modified` | ISO 8601 timestamp of last NVD record update |
| `cvss_v3_score` | CVSS v3 base score (0.0–10.0) |
| `cvss_v3_severity` | CVSS v3 severity label: `LOW`, `MEDIUM`, `HIGH`, or `CRITICAL` |
| `cvss_v3_vector` | Full CVSS v3 vector string |
| `cvss_v2_score` | CVSS v2 base score (legacy, 0.0–10.0) |
| `cwe_ids` | List of CWE weakness classification IDs |
| `affected_products` | List of CPE 2.3 strings for affected product versions |
| `references` | List of external reference URLs (vendor advisories, PoCs, patches) |
| `exploitability_score` | CVSS exploitability sub-score |
| `impact_score` | CVSS impact sub-score |

### Cost estimation

| Scenario | CVEs returned | Estimated Cost |
|----------|--------------|---------------|
| Single product keyword, 30-day window | 10–50 | $0.01–$0.05 |
| Full stack audit (5 keywords), CRITICAL only | 50–200 | $0.05–$0.20 |
| Monthly CVE digest, all severities | 200 | ~$0.20 |
| Annual bulk pull (maxResults 2000) | 2,000 | ~$2.00 |

**Pricing**: $0.001 per run start + **$0.001 per CVE** returned.

Without an NVD API key, the actor sleeps 6 seconds between pages (NVD's 5 req/30s limit). With a free key, it sleeps 0.6 seconds — approximately 10x faster for large batches.

### FAQ

**Do I need an NVD API key to use this actor?**
No — the actor works immediately without any API key. Without a key, NVD enforces a lower rate limit (5 requests per 30 seconds), which slows down large queries. A free key is available in under 2 minutes at [nvd.nist.gov/developers/request-an-api-key](https://nvd.nist.gov/developers/request-an-api-key) and unlocks 10x faster throughput with no usage quota beyond rate limits.

**How do I monitor for new CVEs affecting my stack automatically?**
Use the Apify Scheduler to run this actor daily with `pubStartDate` set to yesterday's date and `keywordSearch` covering your tech stack components. Connect the output to a webhook, Slack integration, or email notification via Apify integrations to receive zero-lag **security vulnerability monitor** alerts.

**Is the CVE data the same as what commercial scanners provide?**
For raw CVE records — yes. Tenable, Qualys, and Rapid7 all source their CVE data from the same NIST NVD API this actor uses. Commercial scanners add value through authenticated host scanning, plugin-based detection, and asset management. This actor is best suited for CVE research, alerting pipelines, and compliance reporting where you already know your asset inventory.

***

**Disclaimer:** This actor retrieves publicly available data from the NIST National Vulnerability Database (NVD) provided by the US government in the public domain. It is not affiliated with NIST, MITRE, or the CVE Program. CVE data should be validated against your specific software versions and deployment configurations before use in security decisions. This actor does not perform authenticated scanning or detect whether vulnerabilities are exploitable in your environment.

**Keywords:** CVE vulnerability tracker, security vulnerability monitor, NVD CVE database API, NIST NVD, CVSS score, cybersecurity, patch management, CWE, CPE, vulnerability scanner, exploit database, security advisory

***

### Related actors

- [SSL Certificate Monitor](https://apify.com/gochujang/ssl-certificate-monitor) — TLS certificate expiry and chain issues that often accompany CVE-related infrastructure risks
- [Domain Breach Checker](https://apify.com/gochujang/domain-breach-checker) — HIBP breach data for organizations with known CVE exposures
- [Shodan Surface Mapper](https://apify.com/gochujang/shodan-surface-mapper) — External attack surface enumeration to identify systems affected by tracked CVEs

### Feedback

If this actor powers your security research, a review helps others find it: [Leave a review on Apify Store](https://apify.com/gochujang/cve-vulnerability-tracker#reviews)

# Actor input Schema

## `mode` (type: `string`):

'search' — keyword search across CVE descriptions. 'recent' — fetch CVEs published in a date range. 'lookup' — retrieve specific CVE IDs.

## `query` (type: `string`):

Keyword(s) to search in CVE descriptions (used in 'search' mode). Example: 'apache log4j' or 'remote code execution'.

## `cveIds` (type: `array`):

Specific CVE identifiers to retrieve (used in 'lookup' mode). Example: \['CVE-2021-44228', 'CVE-2022-22965'].

## `dateFrom` (type: `string`):

Start of the publication date range (used in 'recent' mode). Format: YYYY-MM-DD or YYYY-MM-DDTHH:MM:SS. Example: '2026-08-01'.

## `dateTo` (type: `string`):

End of the publication date range (used in 'recent' mode). Format: YYYY-MM-DD or YYYY-MM-DDTHH:MM:SS. Example: '2026-08-31'.

## `minSeverity` (type: `string`):

Filter out CVEs below this CVSS severity level. Applies to all modes. Scores: NONE=no filter, LOW=0.1-3.9, MEDIUM=4.0-6.9, HIGH=7.0-8.9, CRITICAL=9.0-10.0.

## `maxResults` (type: `integer`):

Maximum number of CVEs to return. NVD returns up to 2000 per paginated request. Higher values incur more API calls.

## `nvdApiKey` (type: `string`):

Optional NIST NVD API key. Without a key: 5 requests/30 sec (6s sleep). With a key: 50 requests/30 sec (0.6s sleep). Get one free at https://nvd.nist.gov/developers/request-an-api-key.

## Actor input object example

```json
{
  "mode": "search",
  "query": "apache log4j",
  "cveIds": [],
  "dateFrom": "",
  "dateTo": "",
  "minSeverity": "NONE",
  "maxResults": 100
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "query": "apache log4j"
};

// Run the Actor and wait for it to finish
const run = await client.actor("gochujang/cve-vulnerability-tracker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "query": "apache log4j" }

# Run the Actor and wait for it to finish
run = client.actor("gochujang/cve-vulnerability-tracker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "query": "apache log4j"
}' |
apify call gochujang/cve-vulnerability-tracker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,gochujang/cve-vulnerability-tracker"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Qluft8nxbnLXwfsOf/builds/dGaZavZGTkHeYzxbB/openapi.json