CVE Vulnerability Scraper: NVD API + CISA KEV + EPSS

Search CVE vulnerabilities from the official NVD (National Vulnerability Database) API by keyword, vendor/product, severity, CWE and date, and get every CVE already enriched with CISA KEV (known exploited in the wild) and FIRST EPSS exploit-probability scores, plus a ready-made priority label. Schedule it for daily CVE alerts that only return new or updated vulnerabilities.

$0.80 per 1,000 CVEs, KEV and EPSS included. Filtered-out and already-seen CVEs are free.

What you get for each CVE

Field	Example
cveId, description	CVE-2021-44228, "Apache Log4j2 ... JNDI features ..."
severity, cvssScore, cvssVersion, cvssVector, attackVector	CRITICAL, 10.0, 3.1, CVSS:3.1/AV:N/..., NETWORK
cvssV3Score, cvssV2Score	10.0, 9.3
cwes	CWE-502, CWE-917
vendorProducts, vendors, affectedCpes (CPE + version range), affectedCpeCount	apache:log4j, versionStartIncluding 2.4.0 + versionEndExcluding 2.12.2
inCisaKev, kevDateAdded, kevDueDate, kevRansomwareUse, kevRequiredAction	true, 2021-12-10, Known
epssScore, epssPercentile, epssDate	0.99999, 1.0
priority	P1 - exploited in the wild (CISA KEV)
exploitReferences, patchReferences, advisoryReferences, references	links tagged by NVD
published, lastModified, vulnStatus, nvdUrl, cveOrgUrl

Priority labels: P1 in CISA KEV; P2 EPSS ≥ 10% (or CVSS ≥ 9 with EPSS ≥ 1%); P3 CVSS ≥ 7 or EPSS ≥ 1%; P4 monitor.

Use cases

• Daily vulnerability alerts for the products you run (product: microsoft:exchange_server, onlyNew: true, schedule daily).
• Patch prioritisation: critical/high CVEs with EPSS ≥ 0.1 or in KEV first.
• Threat intel and security newsletters: new critical CVEs of the week with exploit links.
• Vulnerability management / SBOM checks: look up a list of CVE IDs and get CVSS, KEV and EPSS in one table.
• AI agents and MCP: a clean JSON CVE API for LLM workflows.

Input examples

New critical and high CVEs of the last 7 days (the prefill):

{ "severities": ["CRITICAL", "HIGH"], "publishedFrom": "7 days", "maxItems": 100 }

Everything affecting a product, exploited in the wild only:

{ "product": "fortinet:fortios", "onlyKnownExploited": true, "publishedFrom": "2 years", "maxItems": 0 }

Daily alert of new CVEs for WordPress plugins with a real exploit probability:

{ "keywords": "wordpress plugin", "publishedFrom": "3 days", "minEpss": 0.01, "onlyNew": true, "stateKey": "wp" }

Look up specific CVEs:

{ "cveIds": ["CVE-2021-44228", "CVE-2023-4863", "CVE-2024-3400"] }

Track CVEs NVD updated (new scores, new references) in the last day: "modifiedFrom": "24 hours", "onlyNew": true.

Filters

Keywords (all words, or exact phrase) · vendor/product as vendor:product[:version] or a cpe:2.3 string (NVD matches version ranges) · CVSS v3 severity · CWE · published dates (ranges over 120 days are split automatically) · modified dates · only CISA KEV · minimum CVSS · minimum EPSS · include rejected CVEs · newest or oldest first · max items.

Speed and the optional NVD API key

NVD allows 5 requests per 30 seconds without a key, so the Actor waits ~6.5 s between NVD requests. One request returns up to 2,000 CVEs, so searches are fast; CVE ID lookups need one request each (~6.5 s per CVE). Add your free NVD API key (nvdApiKey, stored as a secret) to make it about 10x faster.

Pricing

Pay per event: $0.0008 per CVE saved (KEV and EPSS enrichment included) + $0.0003 per run start. 1,000 CVEs cost $0.80. Set Maximum cost per run and the Actor stops exactly there.

Data sources and notes

• NVD CVE API 2.0 (NIST, US government open data). This product uses the NVD API but is not endorsed or certified by the NVD.
• CISA Known Exploited Vulnerabilities catalog (public domain), downloaded once per run.
• FIRST EPSS API for exploit prediction scores.
• Only vulnerability metadata is collected. No personal data, no logins, official APIs only, polite request rates.

FAQ

How fresh is the data? Live from NVD on every run. EPSS updates daily, KEV whenever CISA adds a CVE. Why is a new CVE missing a CVSS score? NVD may not have analysed it yet (vulnStatus "Awaiting Analysis"); CNA scores are used when available. Re-run later or use modifiedFrom to catch the update. Can I export to CSV/Excel? Yes, from the dataset tab, or via the Apify API.

Found a problem or need a field? Open an issue on the Actor page and we'll fix it fast.