NVD CVE Monitor

What it does

Fetch new or modified CVEs from the public NVD CVE API 2.0. Add CISA Known Exploited Vulnerabilities flags and detect changes between runs.

This product uses the NVD API but is not endorsed or certified by the NVD.

Input examples

Fetch up to five recently modified Apache CVEs, including records emitted before.

{ "mode": "modified", "lookbackHours": 24, "keywords": ["apache"], "maxItems": 5, "onlyNew": false }

Monitor recently published high or critical CVEs listed in KEV.

{ "mode": "published", "lookbackHours": 168, "severities": ["HIGH", "CRITICAL"], "kevOnly": true, "onlyNew": true }

Input fields

Field	Default	Meaning
mode	modified	modified uses lastModStartDate/lastModEndDate. published uses pubStartDate/pubEndDate.
lookbackHours	24	Window ending at run start, clamped to 1 through 2880 hours, or 120 days. Dates use ISO UTC with the Z offset.
keywords	[]	Each entry becomes one keywordSearch query. Empty means no keyword filter.
cpeNames	[]	Optional exact CPE names. Each is queried with every keyword.
severities	[]	Local filter on LOW, MEDIUM, HIGH, CRITICAL. Empty accepts all.
vendors	[]	Local case-insensitive match on CPE vendor components. Empty accepts all.
kevOnly	false	Emit only CVEs in the CISA KEV catalog.
maxItems	200	Maximum emitted CVEs, clamped to 1 through 10000.
onlyNew	true	Emit new and changed records. False also emits unchanged records.
apiKey	absent	Optional secret personal NVD key, sent in the apiKey header and never logged.
stateStoreName	nvd-cve-monitor-state	Named KV store for CVE history and KEV cache.

CVSS selection prefers v3.1, then v3.0, then v4. Within each version it prefers a Primary metric. CVEs without metrics have null score and severity. Vendor and product lists come from configuration CPE criteria, including environmental criteria. References contain at most 20 distinct URLs. Keywords and CPE queries form a union; filters then apply locally. Duplicate CVE IDs emit once per run.

Output sample

This is a synthetic fixture record, not a claim about a real vulnerability.

{
  "cveId": "CVE-2026-10001",
  "published": "2026-10-19T01:00:00.000",
  "lastModified": "2026-10-20T01:00:00.000",
  "vulnStatus": "Analyzed",
  "description": "Fixture vulnerability in Apache HTTP Server.",
  "cvssVersion": "3.1",
  "cvssScore": 8.8,
  "severity": "HIGH",
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cwes": ["CWE-79"],
  "vendors": ["apache"],
  "products": ["http_server"],
  "references": ["https://example.org/advisory"],
  "kev": true,
  "kevDateAdded": "2026-10-20",
  "kevDueDate": "2026-11-10",
  "kevRansomware": "Unknown",
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-10001",
  "changeType": "new",
  "changedFields": [],
  "checkedAt": "2026-10-20T12:00:00.000Z"
}

The default dataset holds CVEs and uncharged error rows. Errors contain error and checkedAt. The default KV store contains RUN_SUMMARY with timestamps, counts and stoppedAtChargeLimit. counts.fetched counts distinct CVEs that passed source filters and reached main, not every upstream response row.

Change tracking

CVES in the named state store maps IDs to SHA-256 fingerprints and the tracked values. The stable JSON uses the fixed field order lastModified, vulnStatus, cvssScore, severity, kev. changeType is new, changed, or unchanged. changedFields names differing tracked fields and is empty for new records.

History is saved only after a successful dataset push. Charge-limited and failed pushes remain eligible. Pushes and KV writes are separate operations, so a crash between them can cause a duplicate on retry. Avoid concurrent runs sharing one state store. Use different names for independent histories. State grows with emitted CVE IDs.

The CISA catalog is fetched at most once per run and cached for 24 hours under KEV. A failed refresh stops the run rather than falsely clearing KEV flags. KEV changes are detected only for CVEs returned by the current NVD date window. This Actor does not rescan older CVEs outside that window.

Pricing

The PPE event is cve at $0.001 per emitted CVE, or $1 per 1,000 CVEs, with no run fee. Errors and skipped CVEs are not charged. With onlyNew false, repeated unchanged CVEs are charged when emitted. Local runs do not bill PPE. Store pricing must be configured separately as described in PUBLISHING.md.

Limits and terms

NVD requests start at least 6500 ms apart without a key, respecting the public five-requests-per-30-seconds limit. A personal API key changes that interval to 700 ms. Never share a key; use only your own. Schedule incremental modified-date runs no more often than once every two hours, following NVD guidance.

Requests use politeFetch with per-host throttling, HTTP 429 and 5xx retries, exponential backoff, Retry-After support and a 30-second request timeout. NVD pages request 2000 records. The Actor stops at maxItems or the PPE charge limit. Selective local filters may require scanning many pages. API availability and NVD analysis completeness affect results.

NVD data is public domain under Title 17. This Actor extracts source fields without rewriting CVE descriptions. See TERMS.md, NVD terms, NVD API documentation, and the CISA KEV catalog. The terms review supplied with this repository is the basis for these notes.

This Actor is unofficial and is not affiliated with or endorsed by NVD, NIST, or CISA. It uses public documented APIs only, no logos, and no login. CVE and KEV flags are source data, not a complete security assessment.

Local development

Node 20 or newer is required. Run offline tests with npm test. The sample INPUT is a live query limited to five CVEs. npm start normally accesses the public APIs.

Run the real Actor with stubbed HTTP and local storage without network access.

NODE_OPTIONS="--import=./scripts/offline-fetch.js" npm start

The preload accepts only the two source hosts and returns small realistic synthetic API fixtures. Inspect storage/datasets/default/ and storage/key_value_stores/default/RUN_SUMMARY.json. Keep only the sample INPUT in version control. Tests use node:test, stub fetch and temporary local storage.