# NVD CVE Feed - CVSS v4/v3, CISA KEV, CWE, Affected Products (`jpopendata/us-nvd-cve-feed`) Actor CVE records and change history from the official NIST NVD API 2.0: CVSS v4.0/v3.x scores, CWE, CISA KEV and SSVC flags, affected vendors/products/versions (NVD CPE + CNA data), key references. Date, keyword, score, severity, CWE, vendor and CVE ID filters. Unofficial; not affiliated with NIST/NVD. - **URL**: https://apify.com/jpopendata/us-nvd-cve-feed.md - **Developed by:** [JP Open Data](https://apify.com/jpopendata) (community) - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $1.50 / 1,000 results This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event ## What's an Apify Actor? An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md. ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run. For examples already wired to this Actor's own input schema, see the [API](#api) section below. Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`). # README ## NVD CVE Feed — CVSS v4/v3, CISA KEV, CWE, Affected Products Get CVE records from the official **NIST National Vulnerability Database (NVD) API 2.0** as clean, flat rows: CVSS v4.0 / v3.x / v2 scores and vectors, CWE, the **CISA Known Exploited Vulnerabilities (KEV)** flag and dates, **CISA SSVC** exploitation status, **affected vendors / products / version ranges** (from the NVD's CPE data *and* the vendor's own CNA data), and the key references. Or get the **change history**: every change the NVD recorded (new CVE, CVSS added, KEV update, rejection, re-analysis). > This product uses the NVD API but is not endorsed or certified by the NVD. **Unofficial tool — not affiliated with NIST, the NVD, MITRE, the CVE Program or CISA.** ### What you get - **One row per CVE** (or one row per change event) — no nested API structures to unpack. - **CVSS done for you**: the preferred score per version (NVD first, then the CNA), plus `maxCvssScore` / `maxCvssSeverity` = the highest v3.x or v4.0 base score from any source, so you can filter "CRITICAL" without missing CVEs that only have a v4.0 score. - **Known exploited?** `isKev`, `kevDateAdded`, `kevDueDate`, `kevRequiredAction` (CISA KEV), and `ssvcExploitation` (`active` / `poc` / `none`, from CISA's SSVC assessment), `ssvcAutomatable`, `ssvcTechnicalImpact`. - **Affected products, flattened**: `vendors`, `products` and `affectedProducts` (vendor, product, version, version range, CPE) from the NVD's CPE applicability statements **and** from the CVE's own "affected" data published by the CNA. Most new CVEs wait weeks for NVD analysis (status *Received* / *Awaiting Analysis* / *Deferred*, no CPE) — this Actor still tells you which products they affect. - **Vendor / product filter that also finds not-yet-analysed CVEs** (matched against both sources). - **Changes feed**: `dateType: "lastModified"` returns CVEs updated in the window; `mode: "changes"` returns the change events themselves (what changed, old and new values). - **No silent gaps**: long windows are split automatically (the API allows 120 days per query), every page is read until the API's total is covered, and the run summary says whether more rows matched than `maxItems`. - **Works without an API key** (stays under the NVD's public rate limit). Add **your own free NVD API key** to make it faster. ### Quick start — verified input ```json { "daysBack": 7, "maxItems": 100 } ``` Returns the 100 newest CVEs published in the last 7 days (newest first), in about 15 seconds. An empty input `{}` does the same. More examples: ```json { "dateType": "kevAdded", "daysBack": 30, "maxItems": 500 } ``` CVEs added to the CISA KEV catalog in the last 30 days. ```json { "vendor": "microsoft", "severities": ["CRITICAL", "HIGH"], "daysBack": 14, "maxItems": 1000 } ``` High and critical Microsoft CVEs published in the last 14 days (including ones the NVD has not analysed yet). ```json { "cveIds": ["CVE-2021-44228", "CVE-2024-3400", "CVE-2023-4863"] } ``` Look up specific CVEs (up to 2,000 per run). ```json { "dateType": "lastModified", "daysBack": 1, "maxItems": 10000 } ``` Everything that changed in the last 24 hours — the NVD's recommended way to keep a local copy up to date. ```json { "mode": "changes", "daysBack": 2, "eventNames": ["CVE CISA KEV Update", "Initial Analysis"], "maxItems": 1000 } ``` Change events of the last 2 days: KEV updates and first NVD analyses. ### Input | Field | What it does | |---|---| | `mode` | `cves` (CVE records, default) or `changes` (change-history events). | | `daysBack` | Window = the last N days (default 7). Long windows are split automatically. | | `dateType` | `published` (new CVEs, default), `lastModified` (updated CVEs) or `kevAdded` (added to CISA KEV). | | `startDate` / `endDate` | Optional explicit window, `YYYY-MM-DD` or ISO date-time, UTC. | | `keyword` / `exactPhrase` | Words that must appear in the description (the API's keyword search). | | `minCvssScore` | Minimum of the highest CVSS v3.x/v4.0 base score, e.g. `7`. | | `severities` | Any of `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`. | | `cweIds` | e.g. `CWE-79`, `CWE-89` (or `79`). Several = any of them. | | `vendor` / `product` | Names, e.g. `apache` / `log4j`. Matched against NVD CPE **and** CNA data. | | `cpeMatchString` | Advanced: a CPE 2.3 match string the NVD filters on (fast for multi-year history; analysed CVEs only). | | `kevOnly` | Only CVEs in CISA KEV. | | `excludeRejected` | Leave out rejected CVE IDs (default on). | | `cveIds` | Look up these CVEs (the window is ignored). | | `eventNames` | `changes` mode: keep only these events (e.g. `CVE Received`, `Initial Analysis`, `CVE Rejected`). | | `sortOrder` | `newest` (default) or `oldest`. | | `maxItems` | Max rows (default 100). | | `maxApiRequests` | Hard cap on API requests (default 100; each reads up to 500 CVEs or 1,000 events). | | `apiKey` | Optional, **your own** NVD API key ([request one free](https://nvd.nist.gov/developers/request-an-api-key)). | ### Output example (one CVE row, shortened) ```json { "recordType": "cve", "cveId": "CVE-2021-44228", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228", "publishedAt": "2021-12-10T10:15:09.143Z", "lastModifiedAt": "2025-10-27T17:29:54.990Z", "analysisStatus": "Analyzed", "description": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features ...", "maxCvssScore": 10, "maxCvssSeverity": "CRITICAL", "cvssV3Score": 10, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "cvssV3Source": "NVD", "cweIds": ["CWE-917", "CWE-20", "CWE-400", "CWE-502"], "isKev": true, "kevDateAdded": "2021-12-10", "kevDueDate": "2021-12-24", "kevVulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability", "ssvcExploitation": "active", "ssvcAutomatable": "yes", "vendors": ["apache", "siemens", "...", "Apache Software Foundation"], "affectedProducts": [ { "origin": "nvd-cpe", "part": "application", "vendor": "apache", "product": "log4j", "versionStartIncluding": "2.0.1", "versionEndExcluding": "2.3.1", "cpe": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*" }, { "origin": "cna", "vendor": "Apache Software Foundation", "product": "Apache Log4j2", "version": "2.0-beta9", "lessThan": "log4j-core*" } ], "referenceCount": 103, "keyReferences": [{ "url": "https://logging.apache.org/log4j/2.x/security.html", "tags": ["Release Notes", "Vendor Advisory"] }], "hasExploitReference": true, "hasPatchReference": true, "assigner": "apache.org", "source": "NIST National Vulnerability Database (NVD) - CVE API 2.0 / CVE Change History API 2.0", "sourceUrl": "https://nvd.nist.gov/", "license": "This product uses the NVD API but is not endorsed or certified by the NVD. ...", "retrievedAt": "2026-10-13T07:30:00.000Z" } ``` A change row (`mode: "changes"`) has `cveId`, `eventName`, `changeId`, `changedAt`, `assigner`, `changeTypes` (e.g. `["CVSS V3.1", "CWE", "Reference"]`), `detailCount` and `details` (`action`, `type`, `oldValue`, `newValue`). Field notes: - `analysisStatus` is the NVD status: *Received*, *Awaiting Analysis*, *Undergoing Analysis*, *Analyzed*, *Modified*, *Deferred*, *Rejected*. - `cvssV3*` / `cvssV40*` prefer the NVD's own score (Primary) and fall back to the CNA's; every published score is in `cvssMetrics`. CVSS v2 is legacy (the NVD stopped adding it in 2022) and is not part of `maxCvss*`. - `affectedProducts[].origin`: `nvd-cpe` (NVD analysis), `cna` (the vendor/CNA that published the CVE), `adp` (CISA). Only versions marked affected are listed; at most 500 entries per CVE (`affectedProductsTotal` tells the full count). - `assigner` and score sources are given as the organisation's domain (e.g. `redhat.com`), `NVD`, `CISA-ADP`, `CNA` (a CNA that the NVD identifies by a UUID, scoring its own CVE) or that UUID — never as an e-mail address. - `affectedProducts[]` from CPE data also carry `softwareEdition` and `targetSoftware` when the CPE names them (e.g. `fips`, `wordpress`). - Dates are UTC (ISO 8601 with `Z`); KEV dates are `YYYY-MM-DD` as published. ### Common input mistakes | You wrote | Write instead | |---|---| | `"vendor": "cpe:2.3:a:apache:log4j"` | `"vendor": "apache", "product": "log4j"` or `"cpeMatchString": "cpe:2.3:a:apache:log4j"` | | `"cveIds": ["log4shell"]` | `"cveIds": ["CVE-2021-44228"]` (or `"keyword": "log4j"`) | | `"minCvssScore": 75` | `"minCvssScore": 7.5` (CVSS scores go from 0 to 10) | | `"severities": ["urgent"]` | `"severities": ["CRITICAL"]` | | `"startDate": "03/04/2026"` | `"startDate": "2026-03-04"` (day/month order is ambiguous) | | `"kevOnly": true` with `"daysBack": 3` | KEV additions are a few per week: use `"dateType": "kevAdded", "daysBack": 30` | ### Empty results? A run that finds nothing **succeeds with 0 rows** and a warning. Typical causes: - a short window with strict filters (e.g. `kevOnly` over 3 days); - a keyword that is not in any description in the window (the keyword searches the English description only); - a vendor / product spelled differently from the NVD and CNA data — try one distinctive word (`"product": "exchange"`); - a CVE ID the NVD does not have yet (listed in `RUN_SUMMARY.lookups.notFound`); - `mode: "changes"` with an event name that did not occur in the window. ### Speed and limits - **Without an API key** the Actor sends one request every 6.5 seconds (the NVD's public limit is 5 requests per rolling 30 seconds). Each request reads up to 500 CVEs, so 10,000 CVEs take about 3–4 minutes. - **With your own NVD API key** requests are 3 seconds apart (the keyed limit is 50 per 30 seconds; the NVD recommends sleeping a few seconds between requests anyway), and you no longer share the public per-IP limit with other clients. The NVD terms say keys must not be shared, so the Actor has no built-in key — use your own. - Vendor / product filters read every CVE in the window (about 450 new CVEs per day in 2026). Keep the window to weeks, or use `cpeMatchString` for multi-year history. - If the NVD answers HTTP 403 (usually its rate limit), the Actor waits 35 seconds and retries twice. If it keeps refusing, the run stops: rows already collected are kept (`complete: false` in `RUN_SUMMARY`). - Each run stores `RUN_SUMMARY` (window, totals, pages read, stop reason, IDs not found) and `LICENSE` in its key-value store. ### Data source, attribution and licence - **Source**: NIST National Vulnerability Database, [CVE API 2.0 and CVE Change History API 2.0](https://nvd.nist.gov/developers/vulnerabilities), `services.nvd.nist.gov`. Only these two documented endpoints are called. - **NVD notice** (as the [NVD API Terms of Use](https://nvd.nist.gov/developers/terms-of-use) ask): *This product uses the NVD API but is not endorsed or certified by the NVD.* NVD data are a U.S. Government work: "All NIST publications are available in the public domain according to Title 17 of the United States Code". The NVD "Getting Started" page asks for the same notice in these words: *This product uses data from the NVD API but is not endorsed or certified by the NVD.* - **CVE records**: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. Reproduced under the [CVE Terms of Use](https://www.cve.org/Legal/TermsOfUse) licence: > CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. > ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Every row's `license` field carries the NVD notice, MITRE's copyright designation and the CVE Usage licence above, word for word, so every copy of the data you export includes them. For runs in 2026 the field reads: > This product uses the NVD API but is not endorsed or certified by the NVD. NVD data: U.S. Government work (NIST), public domain in the U.S. under Title 17 U.S.C. CVE records: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. \[CVE Terms of Use: https://www.cve.org/Legal/TermsOfUse] Field values are as published by the NVD; derived fields (maxCvss\*, vendors, products, affectedProducts, keyReferences, has\*Reference, referenceCount) are computed by this Actor. Unofficial tool, not affiliated with NIST, the NVD, MITRE or CISA. The year in the designation is the year of the run. The licence, the disclaimer and the links are also saved with every run (`LICENSE` record). - **Values are passed through as published.** Fields computed by this Actor: `maxCvssScore`, `maxCvssSeverity`, `maxCvssVersion`, `vendors`, `products`, `affectedProducts` (a flattened view of the CPE and CNA data), `affectedProductsTotal`, `affectedProductsTruncated`, `hasNvdCpe`, `keyReferences`, `referenceCount`, `referencesWithheld`, `has*Reference`, `changeTypes`, `detailCount`, `assigner`. Dates are re-written with a `Z` (the API returns UTC without an offset). - The API is provided "as is"; the NVD makes no warranty that it will be error free or uninterrupted. NVD analysis lags behind publication for many new CVEs. ### Legal and privacy - **Public data only.** The Actor uses the NVD's public, documented API at its published rate limits. No login, no scraping of web pages. - **Unofficial / not affiliated** with NIST, the NVD, MITRE, the CVE Program or CISA. "NVD", "CVE" and "KEV" name the data source only. - **You are responsible** for using the data in line with the NVD Terms of Use, the CVE Terms of Use and the laws that apply to you. - **GDPR / personal data**: CVE records describe software. The Actor never outputs e-mail addresses: CNA identifiers are reduced to the organisation's domain, and a description, reference URL or change value that contains an e-mail address is withheld (`descriptionWithheld`, `referencesWithheld`, `valueWithheld`), never edited. Contact and credit data are not part of the API. Note that for open-source projects the "vendor" in CVE data can be the developer's own account name (for example a GitHub user who publishes the project) — it is output as published because it identifies the affected software. # Actor input Schema ## `mode` (type: `string`): CVE records (one row per CVE, default) or change-history events (one row per change the NVD recorded: new CVE received, CVSS added, CISA KEV update, rejection, re-analysis ...). ## `daysBack` (type: `integer`): The window ends now and starts this many days ago (UTC). Default 7. Long windows are split automatically into parts of 100 days (the API allows 120 days per query), so a whole year works too — expect about 450 new CVEs per day in 2026. Ignored when Start date is set. ## `dateType` (type: `string`): Published = CVEs added to the NVD in the window (new CVEs). Last modified = CVEs changed in the window (new scores, new products, status changes; the NVD's recommended way to keep a copy up to date). Added to CISA KEV = CVEs added to the Known Exploited Vulnerabilities catalog in the window. Mode "changes" always uses the change date. ## `startDate` (type: `string`): Optional. YYYY-MM-DD (e.g. "2026-01-01"), an ISO date-time ("2026-01-01T09:00:00Z"), "today" or "yesterday". UTC. Overrides Days back. ## `endDate` (type: `string`): Optional. Same formats as Start date; a date means the end of that UTC day. Empty = now. ## `keyword` (type: `string`): Optional. Words that must all appear in the CVE description, e.g. "remote code execution" or "wordpress plugin". Each word also matches longer words ("circle" finds "circles"). Tick Exact phrase to require the words together. ## `exactPhrase` (type: `boolean`): Only CVEs whose description contains the keyword as an exact phrase. ## `minCvssScore` (type: `number`): Optional. Keep CVEs whose highest CVSS v3.x or v4.0 base score (from the NVD or the CNA) is at least this, e.g. 7 or 9.0. 0 = no filter. CVEs without a v3/v4 score are left out when this is above 0. ## `severities` (type: `array`): Optional. Any of LOW, MEDIUM, HIGH, CRITICAL (the band of the highest CVSS v3.x/v4.0 score). Empty = all. ## `cweIds` (type: `array`): Optional. Weakness types, e.g. "CWE-79" (XSS), "CWE-89" (SQL injection), "CWE-787" (out-of-bounds write); "79" also works, as do NVD-CWE-noinfo and NVD-CWE-Other. Several = any of them. ## `vendor` (type: `string`): Optional. Vendor name, e.g. "microsoft", "apache", "palo alto networks". Case and spacing are ignored and whole words must match. Checked against the NVD's CPE data AND the vendor's own (CNA) data, so CVEs the NVD has not analysed yet are found too. Long windows read every CVE in the window, so keep the window short or use CPE match string for multi-year history. ## `product` (type: `string`): Optional. Product name, e.g. "exchange server", "log4j", "pan-os". Works like Vendor (the last word may be the start of a word: "log4j" also finds "log4j2"). With Vendor, both must match the same product entry. ## `cpeMatchString` (type: `string`): Optional. A CPE 2.3 match string the NVD filters on, e.g. "cpe:2.3:a:apache:log4j" or "cpe:2.3:o:microsoft:windows_10:1607". Fast for multi-year history, but only finds CVEs the NVD has analysed (with CPE data). ## `kevOnly` (type: `boolean`): Only CVEs in CISA's Known Exploited Vulnerabilities catalog. ## `excludeRejected` (type: `boolean`): Leave out CVE IDs that were rejected (withdrawn, duplicates). Default on. Not applied to CVE ID lookups. ## `cveIds` (type: `array`): Optional. Look up these CVEs directly, e.g. "CVE-2021-44228" ("2021-44228" also works). When set, the date window is ignored and every listed CVE is returned (Max rows does not apply in mode "cves"); the filters above still apply. Up to 2,000 per run, 100 per request. IDs the NVD does not have are listed in RUN_SUMMARY.lookups.notFound. In mode "changes" you get the full change history of these CVEs. ## `eventNames` (type: `array`): Optional, mode "changes" only. Keep only these change events, e.g. "CVE Received", "Initial Analysis", "Reanalysis", "CVE Modified", "Modified Analysis", "CVE CISA KEV Update", "CVE Rejected", "CVE Status Change". Case and spacing are ignored. Empty = all. ## `sortOrder` (type: `string`): Newest first (default) or oldest first. CVE records are ordered by published date, change events by change date. ## `maxItems` (type: `integer`): Stop after this many rows (default 100, up to 100,000). The run summary says when more rows matched than this. ## `maxApiRequests` (type: `integer`): Hard cap on requests to the NVD API (default 100; each reads up to 500 CVEs or 1,000 change events). Without a key requests are 6.5 s apart, so 100 requests take about 11 minutes plus download time. ## `apiKey` (type: `string`): Optional. Your own free NVD API key (request one at https://nvd.nist.gov/developers/request-an-api-key). With it, requests are 3 s apart instead of 6.5 s and you do not share the public per-IP limit. The NVD terms say a key must not be shared, so use your own. It is sent only to the NVD API as the apiKey header and never stored in the output or logs. ## Actor input object example ```json { "mode": "cves", "daysBack": 7, "dateType": "published", "startDate": "", "endDate": "", "keyword": "", "exactPhrase": false, "minCvssScore": 0, "severities": [], "cweIds": [], "vendor": "", "product": "", "cpeMatchString": "", "kevOnly": false, "excludeRejected": true, "cveIds": [], "eventNames": [], "sortOrder": "newest", "maxItems": 100, "maxApiRequests": 100 } ``` # Actor output Schema ## `records` (type: `string`): One row per CVE (mode cves) or per change event (mode changes), each with the NVD notice, the CVE (MITRE) copyright designation and the CVE Usage licence in license (source, sourceUrl, license, retrievedAt). # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "mode": "cves", "daysBack": 7, "dateType": "published", "startDate": "", "endDate": "", "keyword": "", "exactPhrase": false, "minCvssScore": 0, "severities": [], "cweIds": [], "vendor": "", "product": "", "cpeMatchString": "", "kevOnly": false, "excludeRejected": true, "cveIds": [], "eventNames": [], "sortOrder": "newest", "maxItems": 100, "maxApiRequests": 100 }; // Run the Actor and wait for it to finish const run = await client.actor("jpopendata/us-nvd-cve-feed").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "mode": "cves", "daysBack": 7, "dateType": "published", "startDate": "", "endDate": "", "keyword": "", "exactPhrase": False, "minCvssScore": 0, "severities": [], "cweIds": [], "vendor": "", "product": "", "cpeMatchString": "", "kevOnly": False, "excludeRejected": True, "cveIds": [], "eventNames": [], "sortOrder": "newest", "maxItems": 100, "maxApiRequests": 100, } # Run the Actor and wait for it to finish run = client.actor("jpopendata/us-nvd-cve-feed").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "mode": "cves", "daysBack": 7, "dateType": "published", "startDate": "", "endDate": "", "keyword": "", "exactPhrase": false, "minCvssScore": 0, "severities": [], "cweIds": [], "vendor": "", "product": "", "cpeMatchString": "", "kevOnly": false, "excludeRejected": true, "cveIds": [], "eventNames": [], "sortOrder": "newest", "maxItems": 100, "maxApiRequests": 100 }' | apify call jpopendata/us-nvd-cve-feed --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,jpopendata/us-nvd-cve-feed" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/IcYeye471urOvo14A/builds/Vp7pAWEV9Z99s8L2b/openapi.json