NVD CVE Applicability Detail Export

Refresh a selected CVE watchlist into complete source CVSS metrics and CPE applicability data for downstream security triage.

Input

cveIds accepts 1–20 CVE identifiers. The default is CVE-2021-44228. Identifiers normalize to uppercase and duplicates are fetched/charged once. Blank, malformed, unknown keys, or more than 20 entries fail before requests. Every requested unique CVE must be present in NVD; unknown or not-yet-ingested identifiers fail the whole batch.

Output

One row per unique CVE with source status, language-tagged descriptions, complete published/lastModified timestamps, every CVSS source/version array, weaknesses, all reference URLs/tags, and the full CPE applicability boolean configurations. AND/OR/negate, nested nodes, vulnerable flags and inclusive/exclusive version bounds remain intact. No affected-package claim or severity-selection shortcut is computed. Missing metrics/configurations remain empty; rejected and awaiting-analysis statuses stay visible. Metric/reference contact identifiers are normalized to their public organization domain. Each row includes official URLs, an explicit jpmarketdata derived-output label, source no-endorsement notice and modification notice. The transformed record is not presented as NVD-authored content. Source access remains documented in apiUrl and termsUrl. SUMMARY in key-value storage provides coverage/counts.

Limits

Acquisition deadline180seconds and delivery deadline90seconds; per-request timeout30seconds. Total transfer/decoded budget64MiB; staged output24MiB. 20 input entries and 20 unique output rows; one public API cveIds batch query. At least 6.5 seconds between requests; 429/5xx fail explicitly without an automatic retry. NVD limits are shared by source IP across concurrent runs; avoid simultaneous schedules and rerun exhausted 429 errors later. No API key, keyword search, package scanning, exploit code, external paid service, or browser is used. Error responses, truncated coverage, unexpected duplicate/extra source identities, malformed JSON, schema changes, auth blocks, and timeout fail visibly before output.

Pricing

One cve-delivered event per validated unique dataset row at $0.002; no start fee/trial events. Complete requested coverage is checked before saving rows. If the configured Apify event budget permits fewer rows than unique selected IDs, fail before requests and charges. Repeated refresh runs incur delivery events again. Duplicates, failed requests and SUMMARY are not charged.

Privacy

Only public vulnerability information is delivered. Source contact identifiers are reduced to organization domains; no email addresses, profiles, credentials, cookies or response headers are collected. Advisory links are preserved but not fetched.

This product uses data from the NVD API but is not endorsed or certified by the NVD. NIST data is provided AS IS. Users must verify its accuracy, currency, and suitability before downstream decisions.