CVE Scraper: NVD Vulnerabilities with CVSS, CWE & CISA KEV

Search CVE vulnerabilities, most recent first, and get clean JSON with CVSS scores, CWE weaknesses, affected products, the CISA Known Exploited flag and vendor advisories.

This product uses the NVD API but is not endorsed or certified by the NVD.

This Actor is independent. It is not affiliated with, sponsored by or endorsed by NIST, the NVD, CISA or the CVE Program.

What data can you get?

Each result is one published CVE. Rejected CVEs are left out.

Field	Description
cveId	CVE identifier
publishedAt, lastModifiedAt	Publication and last update dates
status	NVD analysis status, such as Analyzed or Awaiting Analysis
description	Description, in English when available
cvssVersion, cvssScore, cvssSeverity, cvssVector, attackVector	Base score, from the newest CVSS 3.x version, then 4.0, then 2.0
cweIds	CWE weakness identifiers
products	Affected products, 50 at most: vendor:product once analyzed, the product name alone before
isKnownExploited, knownExploitedAddedAt, knownExploitedDueAt	Listed in the CISA KEV catalog, date added and remediation due date
advisoryUrls	Vendor advisories, patches and government resources, 10 at most
nvdUrl	Link to the public record

How to use it

1. Enter a keyword, or choose a severity, a CWE or a date range.
2. Turn on Known exploited only to focus on what attackers really use.
3. Run the Actor, then download the results as JSON, CSV or Excel, or schedule it to monitor new CVEs.

Input example

{
  "keyword": "wordpress",
  "severity": "CRITICAL",
  "maxItems": 100
}

Output example

{
  "cveId": "CVE-2026-96192",
  "publishedAt": "2026-10-29T16:20:08.347",
  "lastModifiedAt": "2026-10-31T00:47:17.857",
  "status": "Analyzed",
  "description": "Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.",
  "cvssVersion": "3.1",
  "cvssScore": 8.8,
  "cvssSeverity": "HIGH",
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "attackVector": "NETWORK",
  "cweIds": [
    "CWE-416"
  ],
  "products": [
    "microsoft:edge"
  ],
  "isKnownExploited": false,
  "knownExploitedAddedAt": null,
  "knownExploitedDueAt": null,
  "advisoryUrls": [
    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96192"
  ],
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-96192"
}

Pricing

This Actor is free to use during its launch. You only pay for Apify platform usage.

Limits

• The most recent CVEs are often not analyzed yet: their score, CWE or advisory links can be missing, and they fill in later. Use status to spot them.
• A date range cannot exceed 120 days. This limit comes from the source.
• A run returns 5,000 vulnerabilities at most. To go further, split your search by date.
• Without an API key, the Actor waits 6.5 seconds between calls to respect the public rate limit. Each call returns up to 500 CVEs. If many runs share the limit, a run can fail with an "NVD API is unavailable" message: try again later, or add your own free NVD API key.
• products uses the vendor name from the NVD. A small vendor can be a person who publishes software under their own name.

FAQ

Where does the data come from?

From the public NVD API, which also carries the CISA KEV flag. This Actor selects fields without changing their values, returns the most recent CVEs first and adds a stable output format.

Does the output contain personal data?

Source e-mail addresses and third-party links (personal repositories, blogs) are not included. Each record is also checked before being saved, and any record that seems to contain an e-mail or a phone number is skipped and logged. See the note on vendor names in Limits.

Why are the most recent CVEs first?

The source returns the oldest first. This Actor reads the pages backwards, so maxItems keeps the newest results.

Why did my run return no results?

Your filters are probably too narrow. Try a shorter keyword, or remove the severity or the CWE.

Why did my run fail with an "Invalid" message?

The message names the field to fix. CWEs use the CWE-79 format and dates use the YYYY-MM-DD format.

Keywords

CVE, CVE scraper, CVE API, NVD, NVD API, vulnerability database, CVSS, CWE, CISA KEV, known exploited vulnerabilities, security advisories, threat intelligence, vulnerability management.