CVE Security Advisory Monitor — NVD + GitHub Advisory + OSV Vulnerability Feed (No API key)

Monitor CVEs and security advisories from NVD (NIST), GitHub Security Advisories and OSV.dev — merged, deduplicated and normalized into one clean feed. Track today's new CVEs, search by keyword (log4j, wordpress rce), or look up a package (npm:express, pypi:django). Every row carries the CVE ID, CVSS score & severity, CVSS vector, CWE weaknesses, affected packages/versions, patched version and reference URLs in structured JSON — straight from each source's public API. No API key, no headless browser, no login.

🏆 Why this CVE advisory monitor?

19 fields per advisory · hundreds of fresh CVEs per day · 3 sources merged & deduplicated · direct HTTP + JSON (no browser) · proxy IP-rotation ready · export to JSON / CSV / Excel. The unofficial NVD / OSV API alternative for DevSecOps triage, dependency/SBOM monitoring, threat intel and AI-agent vulnerability grounding.

---

✨ What this Actor does / Key features

• 🛡️ 3 sources, one feed — NVD CVEs, GitHub Security Advisories (GHSA) and OSV.dev normalized into a single schema, so you query once instead of parsing three formats.
• 🔀 Cross-source dedup — the same vulnerability found in NVD + GHSA + OSV collapses into one row; sourceFeeds lists every carrier, duplicateCount counts them, and the richest fields (summary, CVSS, patch version, CWE) win.
• 📅 Daily new-CVE monitoring — recent mode pulls everything published in the last N days across NVD + GitHub Advisory; daysBack: 1 = today's CVEs, ideal for a scheduled morning run.
• 🔍 Keyword search — search mode runs NVD keywordSearch for topical queries (log4j, apache struts, wordpress plugin); bulk mode runs many keywords in one go.
• 📦 Product / package lookup — product mode queries OSV for vulnerabilities affecting specific packages (npm:express, pypi:django, maven:org.springframework:spring-core) — built for dependency and SBOM scanning.
• 📊 CVSS + severity — cvssScore, cvssSeverity (LOW/MEDIUM/HIGH/CRITICAL) and cvssVector on every scored advisory, plus a minCvss filter to keep only High+ (7.0+) or Critical (9.0+).
• 🏷️ CWE weaknesses & affected versions — weaknesses array (CWE-79, CWE-89 …), affected products/packages with version ranges, and patchedVersion extracted from fix events.
• 🔗 References & IDs — cross-linked cveId, ghsaId, osvId plus a references array of advisory/patch/vendor URLs for every row.
• ⚡ Direct HTTP + JSON extraction — pure REST calls to services.nvd.nist.gov, api.github.com/advisories and api.osv.dev on a small Node 20 container; no browser, no DOM walking, no GraphQL token.
• 🌐 Proxy IP rotation — Apify datacenter proxy rotates the source IP per request to spread NVD's keyless 5 req/30s and GitHub's 60 req/hr/IP limits; 429/5xx responses trigger exponential-backoff retry.

🚀 Quick start (3 steps)

1. Configure — pick a mode (recent, search, product or bulk) and its query. For daily monitoring, leave mode: recent with daysBack: 1.
2. Run — click Start. The Actor queries each source, paginates, merges and deduplicates, then streams advisories into your dataset.
3. Get your data — open the Output tab and export to JSON, CSV, Excel or XML, or pull it via the Apify API. Use the Overview view to scan newest-first or the By severity view to triage.

📥 Input

Pick a mode — everything else is optional and mode-dependent (recent uses daysBack; search/bulk use query/queries; product uses products).

Example — today's new CVEs (schedule this daily)

{
  "mode": "recent",
  "daysBack": 1,
  "sources": ["nvd", "githubAdvisory"],
  "maxResults": 500,
  "useApifyProxy": true
}

Example — last week's High+ advisories (triage)

{
  "mode": "recent",
  "daysBack": 7,
  "minCvss": 7,
  "sources": ["nvd", "githubAdvisory", "osv"],
  "maxResults": 1000
}

Example — dependency scan by package (SBOM)

{
  "mode": "product",
  "products": ["npm:express", "pypi:django", "maven:org.springframework:spring-core"],
  "sources": ["osv"]
}

Example — keyword monitoring

{
  "mode": "search",
  "query": "log4j",
  "maxResults": 200
}

Field	Type	Description
mode	string	recent (new CVEs in last N days), search (keyword), product (packages/OSV) or bulk (many keywords). Required.
daysBack	integer	Days back for recent mode (1–120). 1 = today's CVEs, 7 = last week.
query	string	Keyword for search mode, matched against CVE descriptions (e.g. log4j, wordpress, rce).
queries	array	Array of keywords for bulk mode (each becomes its own query).
products	array	Packages for product mode as ecosystem:package (e.g. npm:express, pypi:django). Bare names auto-guess the ecosystem.
sources	array	Which databases to query: nvd, githubAdvisory, osv. More sources = broader coverage + cross-source dedup.
maxResults	integer	Cap on advisories saved per query/window (1–5000).
minCvss	number	Keep only advisories with CVSS ≥ this (0–10). 0 = all, 7 = High+, 9 = Critical.
useApifyProxy	boolean	Route through Apify datacenter proxy (IP rotation to spread keyless NVD/GitHub rate limits). Recommended.
proxyGroups	array	Override proxy group, e.g. ["RESIDENTIAL"].

Picking sources: NVD is the CVE authority but slow to enrich (package ranges, fix versions). GitHub Advisory adds package-level affected ranges + fix versions fast. OSV merges ecosystem DBs (RUSTSEC, PyPA, Go, npm, PyPI …) that NVD lacks. Query all three for the widest coverage — dedup keeps the feed clean.

📤 Output

One row per vulnerability advisory — 19 fields, merged & deduplicated across sources, exportable to JSON, CSV, Excel or XML. Here is a trimmed sample record:

{
  "query": "last 1d",
  "source": "nvd",
  "sourceFeeds": ["nvd", "githubAdvisory"],
  "cveId": "CVE-2026-12345",
  "ghsaId": "GHSA-abcd-efgh-1234",
  "osvId": null,
  "summary": "SQL injection in package X via parameter Y",
  "description": "A SQL injection vulnerability exists in package X when parameter Y is not sanitized ...",
  "publishedDate": "2026-07-02T13:00:00.000Z",
  "lastModified": "2026-07-02T14:30:00.000Z",
  "cvssScore": 9.8,
  "cvssSeverity": "CRITICAL",
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "weaknesses": ["CWE-89"],
  "affected": [
    { "ecosystem": "pypi", "package": "django", "ranges": [{ "introduced": "0", "fixed": "4.2.1" }] }
  ],
  "patchedVersion": "4.2.1",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-12345",
    "https://github.com/example/pkg/security/advisories/GHSA-abcd-efgh-1234"
  ],
  "duplicateCount": 2,
  "scrapedAt": "2026-07-06T12:00:00.000Z"
}

💡 Use cases

• Daily CVE triage — schedule recent with daysBack: 1 and minCvss: 7 to surface yesterday's High+ CVEs each morning, ranked by severity.
• Dependency & SBOM monitoring — feed your lockfile packages into product mode against OSV, then fail a build or open a ticket when an unpatched vuln appears (use patchedVersion for the upgrade target).
• Patch prioritization — rank open advisories by cvssScore + affected-package criticality + patch availability, and draft remediation tickets.
• Vendor / product monitoring — search: "apache struts" or search: "wordpress plugin" weekly to watch a vendor's or ecosystem's new CVEs.
• Threat-intel & SIEM feed — push merged, deduplicated advisories into a SIEM or ticketing system; cross-source dedup prevents duplicate alerts.
• AI-agent / RAG grounding — embed the daily CVE feed into a vector store so a security agent answers "is X version vulnerable to Y?" with citations to the exact CVE instead of stale training data.

👥 Who uses it

DevSecOps & platform-security engineers · vulnerability-management & SOC analysts · threat-intelligence teams · SBOM / dependency-scanning tools · AI-agent & RAG builders grounding LLMs on current CVE data · security researchers tracking a vendor or ecosystem.

💰 Pricing

This Actor runs on a simple pay-per-result model — you pay per saved advisory, not per run, with no separate Apify platform fees to calculate. Runs that yield zero advisories are free. Try it on the free tier first, then scale up. See the Pricing tab on this page for the current rate.

❓ Frequently Asked Questions

Does NVD / OSV have a public API, and is this an NVD API alternative? NVD, GitHub Security Advisories and OSV each expose a public keyless API, but every one has a different schema, different gaps and its own rate limits. This Actor works as an unofficial NVD / OSV API alternative: it queries all three, normalizes them into one schema, merges duplicates and returns a single clean feed — no key, no schema juggling.

Do I need an API key or a login? No. All three sources have keyless tiers and this Actor uses them, plus Apify datacenter proxy IP rotation to spread the keyless rate limits. Only an Apify account is required. (For very heavy production use NVD offers a free key that raises the limit — but this Actor doesn't need one.)

Can I monitor CVEs without an API or scraping NVD HTML? Yes. The Actor calls each source's official JSON API over direct HTTP — no NVD HTML parsing, no headless browser, no GraphQL token. You get structured advisories back straight away.

How do I export CVE data to CSV or JSON? Run the Actor, then export the resulting dataset as CSV, JSON, Excel or XML from the Apify console or via the Apify API. Use the Overview or By severity dataset view to shape the columns first.

How much data can I get / how current is it? Hundreds of fresh CVEs are published per day, so recent mode gives consistent volume; maxResults caps each window (up to 5000). NVD and GitHub Advisory publish in near-real-time — daysBack: 1 returns CVEs from the last 24 hours, with a small lag (minutes to hours) between disclosure and NVD enrichment.

Why three sources instead of just NVD? NVD is the CVE authority but often lags on enrichment. GitHub Advisory adds package-level affected ranges and fix versions fast. OSV merges ecosystem-specific DBs (RUSTSEC, PyPA, Go, npm, PyPI …) that NVD covers poorly. Merging all three plus dedup gives the broadest, richest coverage.

How does the cross-source dedup work?

Rows are keyed by CVE ID (or GHSA/OSV ID if no CVE exists). The same vuln found in NVD + GHSA + OSV collapses into one row with sourceFeeds: ["nvd","githubAdvisory","osv"] and duplicateCount: 3. The richest fields win — summary from GHSA, CVSS from NVD, patch version from GHSA/OSV.

Can I look up vulnerabilities for a specific package or version?

Yes. product mode queries OSV with a package name (npm:express, pypi:django) and returns all known vulns for it. For an exact-version check, post-process the affected version ranges (introduced/fixed) downstream.

Why are some CVSS scores null?

Not every advisory has a CVSS score yet (especially fresh OSV entries before NVD enrichment). minCvss: 0 keeps them; minCvss: 7 filters them out, since a null score is treated as below the threshold.

Will I get rate-limited?

NVD keyless is 5 req/30s and GitHub is 60 req/hr/IP. The Actor uses proxy IP rotation plus exponential-backoff retry to push through, and paces itself between pages. For very large windows it trades speed for reliability.

Is it legal to monitor CVE / advisory data? The Actor only queries publicly available vulnerability databases via their keyless APIs. The data is owned by the respective sources (NIST, GitHub, OSV maintainers) — respect their Terms of Service and rate limits. Use it for security monitoring, DevSecOps automation and AI-agent grounding on data that is already public.

🔗 More AI research & intelligence scrapers by logiover

Building a security or intelligence pipeline? Pair the CVE monitor with the rest of the logiover AI-research & intel suite:

Actor	What it does
npm Package Intelligence Scraper	npm package metadata, versions & dependency signals for dependency hygiene
GitHub Repository Scraper	Repo metadata, stars, topics & release data
GitHub Activity Stream	Commits, releases & security-relevant repo activity (dev-side signals)
News Intelligence Scraper	Breach / security news coverage across many outlets
Google News Scraper	Topical news monitoring for vendors & incidents
Company Deep Research Scraper	Multi-source company intelligence & attribution context
AI Deep Research	Autonomous multi-step research over a topic
AI Web Search	Programmatic web search for agent pipelines
AI Web Extract	Structured extraction from any page for RAG
Discussion Intelligence Scraper	Forum / community discussion signals & sentiment
Semantic Scholar Research Scraper	Academic papers for deeper technical research
arXiv Paper Scraper	arXiv preprints for security & ML research

👉 Browse all logiover scrapers on Apify Store — 180+ actors across real estate, jobs, crypto, social media & B2B data.

⏰ Scheduling & integration

Schedule this Actor on Apify to run recent mode every morning (daysBack: 1) for a continuous daily CVE feed, or weekly for a broader sweep. Export results to JSON, CSV or Excel, sync to Google Sheets, or push to your database, SIEM, BI tools and webhooks through the Apify API. Connect it to Make, n8n or Zapier — or wrap it as an MCP tool so a security AI agent calls it with a keyword, package or date window and gets structured advisories back.

⭐ Support & feedback

Found a bug or need an extra field? Open an issue on the Issues tab — response is usually fast. If this Actor saves you time, a ★★★★★ review on the Store page genuinely helps and is hugely appreciated. 🙏

⚖️ Legal

This Actor queries only publicly available vulnerability data (NVD, GitHub Security Advisories, OSV) via their keyless APIs and is intended for legitimate security monitoring, DevSecOps automation and AI-agent grounding. Vulnerability data is owned by the respective sources; you are responsible for complying with their terms of service, rate limits, GDPR and any applicable local laws.

---

📝 Changelog

2026-07-06

• ✨ README overhaul: richer output sample, ready-to-run example scenarios, cross-suite links, and clearer quick-start.

2026-07-02 — v1.0

• Initial release.
• 4 modes: recent, search, product, bulk.
• 3 sources: NVD, GitHub Security Advisories, OSV.
• Cross-source dedup (CVE/GHSA/OSV key), CVSS + severity + vector, CWE weaknesses, affected versions, patched version, references.
• minCvss severity filter.
• Apify datacenter proxy default (IP rotation for rate limits).
• Pay-per-result (result event per saved advisory).