# CVE Vulnerability Scraper: NVD API + CISA KEV + EPSS (`manageable_gully/cve-vulnerability-scraper`) Actor

Search CVEs from the official NVD API by keyword, vendor/product, severity, CWE and date. Each CVE comes with CVSS, CISA KEV exploited status, EPSS score and a priority label. Daily CVE alerts. $0.80 per 1,000 CVEs.

- **URL**: https://apify.com/manageable_gully/cve-vulnerability-scraper.md
- **Developed by:** [WebIntel Tools](https://apify.com/manageable_gully) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.80 / 1,000 cve records

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CVE Vulnerability Scraper: NVD API + CISA KEV + EPSS

Search **CVE vulnerabilities** from the official **NVD (National Vulnerability Database) API** by keyword, vendor/product, severity, CWE and date, and get every CVE already **enriched with CISA KEV** (known exploited in the wild) and **FIRST EPSS** exploit-probability scores, plus a ready-made priority label. Schedule it for **daily CVE alerts** that only return new or updated vulnerabilities.

**$0.80 per 1,000 CVEs**, KEV and EPSS included. Filtered-out and already-seen CVEs are free.

### What you get for each CVE

| Field | Example |
|---|---|
| `cveId`, `description` | CVE-2021-44228, "Apache Log4j2 ... JNDI features ..." |
| `severity`, `cvssScore`, `cvssVersion`, `cvssVector`, `attackVector` | CRITICAL, 10.0, 3.1, CVSS:3.1/AV:N/..., NETWORK |
| `cvssV3Score`, `cvssV2Score` | 10.0, 9.3 |
| `cwes` | CWE-502, CWE-917 |
| `vendorProducts`, `vendors`, `affectedCpes` (CPE + version range), `affectedCpeCount` | apache:log4j, versionStartIncluding 2.4.0 + versionEndExcluding 2.12.2 |
| `inCisaKev`, `kevDateAdded`, `kevDueDate`, `kevRansomwareUse`, `kevRequiredAction` | true, 2021-12-10, Known |
| `epssScore`, `epssPercentile`, `epssDate` | 0.99999, 1.0 |
| `priority` | P1 - exploited in the wild (CISA KEV) |
| `exploitReferences`, `patchReferences`, `advisoryReferences`, `references` | links tagged by NVD |
| `published`, `lastModified`, `vulnStatus`, `nvdUrl`, `cveOrgUrl` | |

Priority labels: **P1** in CISA KEV; **P2** EPSS ≥ 10% (or CVSS ≥ 9 with EPSS ≥ 1%); **P3** CVSS ≥ 7 or EPSS ≥ 1%; **P4** monitor.

### Use cases

- **Daily vulnerability alerts** for the products you run (`product: microsoft:exchange_server`, `onlyNew: true`, schedule daily).
- **Patch prioritisation**: critical/high CVEs with EPSS ≥ 0.1 or in KEV first.
- **Threat intel and security newsletters**: new critical CVEs of the week with exploit links.
- **Vulnerability management / SBOM checks**: look up a list of CVE IDs and get CVSS, KEV and EPSS in one table.
- **AI agents and MCP**: a clean JSON CVE API for LLM workflows.

### Input examples

New critical and high CVEs of the last 7 days (the prefill):

```json
{ "severities": ["CRITICAL", "HIGH"], "publishedFrom": "7 days", "maxItems": 100 }
```

Everything affecting a product, exploited in the wild only:

```json
{ "product": "fortinet:fortios", "onlyKnownExploited": true, "publishedFrom": "2 years", "maxItems": 0 }
```

Daily alert of new CVEs for WordPress plugins with a real exploit probability:

```json
{ "keywords": "wordpress plugin", "publishedFrom": "3 days", "minEpss": 0.01, "onlyNew": true, "stateKey": "wp" }
```

Look up specific CVEs:

```json
{ "cveIds": ["CVE-2021-44228", "CVE-2023-4863", "CVE-2024-3400"] }
```

Track CVEs NVD updated (new scores, new references) in the last day: `"modifiedFrom": "24 hours", "onlyNew": true`.

### Filters

Keywords (all words, or exact phrase) · vendor/product as `vendor:product[:version]` or a `cpe:2.3` string (NVD matches version ranges) · CVSS v3 severity · CWE · published dates (ranges over 120 days are split automatically) · modified dates · only CISA KEV · minimum CVSS · minimum EPSS · include rejected CVEs · newest or oldest first · max items.

### Speed and the optional NVD API key

NVD allows 5 requests per 30 seconds without a key, so the Actor waits ~6.5 s between NVD requests. One request returns up to 2,000 CVEs, so searches are fast; CVE ID lookups need one request each (~6.5 s per CVE). Add your **free NVD API key** (`nvdApiKey`, stored as a secret) to make it about 10x faster.

### Pricing

Pay per event: **$0.0008 per CVE** saved (KEV and EPSS enrichment included) + $0.0003 per run start. 1,000 CVEs cost $0.80. Set *Maximum cost per run* and the Actor stops exactly there.

### Data sources and notes

- [NVD CVE API 2.0](https://nvd.nist.gov/developers/vulnerabilities) (NIST, US government open data). *This product uses the NVD API but is not endorsed or certified by the NVD.*
- [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (public domain), downloaded once per run.
- [FIRST EPSS API](https://www.first.org/epss/) for exploit prediction scores.
- Only vulnerability metadata is collected. No personal data, no logins, official APIs only, polite request rates.

### FAQ

**How fresh is the data?** Live from NVD on every run. EPSS updates daily, KEV whenever CISA adds a CVE.
**Why is a new CVE missing a CVSS score?** NVD may not have analysed it yet (`vulnStatus` "Awaiting Analysis"); CNA scores are used when available. Re-run later or use `modifiedFrom` to catch the update.
**Can I export to CSV/Excel?** Yes, from the dataset tab, or via the Apify API.

Found a problem or need a field? Open an issue on the Actor page and we'll fix it fast.

# Actor input Schema

## `keywords` (type: `string`):

Words searched in CVE descriptions (e.g. 'log4j', 'wordpress plugin', 'sql injection'). All words must appear. Empty = no keyword filter.

## `exactPhrase` (type: `boolean`):

Match the keywords as one exact phrase.

## `product` (type: `string`):

Only CVEs affecting this product: 'vendor:product' (e.g. apache:log4j, microsoft:exchange_server), 'vendor:product:version' (e.g. apache:http_server:2.4.49) or a full cpe:2.3 string. Version ranges are matched by NVD.

## `severities` (type: `array`):

Only CVEs with these CVSS v3 severities. Empty = all.

## `publishedFrom` (type: `string`):

YYYY-MM-DD or relative ('24 hours', '7 days', '2 weeks', '6 months', '2 years'). Ranges longer than 120 days are split automatically. If no filter at all is set, the last 7 days are used.

## `publishedTo` (type: `string`):

YYYY-MM-DD or relative. Default: now.

## `onlyKnownExploited` (type: `boolean`):

Only CVEs in CISA's Known Exploited Vulnerabilities catalog (actively exploited in the wild).

## `minCvssScore` (type: `number`):

Drop CVEs below this base score (0-10, newest CVSS version available: 4.0, 3.1, 3.0, then 2.0). Filtered CVEs are free.

## `minEpss` (type: `number`):

Drop CVEs whose EPSS exploit probability (next 30 days) is below this value, e.g. 0.1 = 10%. Filtered CVEs are free.

## `cweId` (type: `string`):

Only CVEs with this weakness, e.g. CWE-79 (XSS), CWE-89 (SQL injection), CWE-787.

## `cveIds` (type: `array`):

Look up specific CVEs (e.g. CVE-2021-44228). When set, the search filters above are ignored, except severity, KEV and minimum scores. Without an NVD API key each lookup takes ~6.5 s (NVD rate limit).

## `modifiedFrom` (type: `string`):

Only CVEs changed since this date or relative time (new analysis, new CVSS score, new references). Max window 120 days. Combine with 'Only new' for an update feed.

## `modifiedTo` (type: `string`):

YYYY-MM-DD or relative. Default: now.

## `onlyNew` (type: `boolean`):

Remember CVEs already returned (per state key) and only output new ones on the next run. Schedule the Actor for daily CVE alerts. With 'Modified from', a CVE is returned again when NVD updates it.

## `stateKey` (type: `string`):

Name of the memory used by 'Only new'. Use a different key per watch list.

## `sort` (type: `string`):

Output order.

## `maxItems` (type: `integer`):

Maximum CVEs to save. 0 = no limit.

## `enrichKev` (type: `boolean`):

Add date added, due date, ransomware use and required action from CISA's KEV catalog. No extra charge.

## `enrichEpss` (type: `boolean`):

Add FIRST EPSS exploit probability and percentile. No extra charge.

## `maxCpesPerCve` (type: `integer`):

How many affected product configurations (CPE + version range) to include per CVE. The full count is always given.

## `includeRejected` (type: `boolean`):

Also return CVEs with status Rejected.

## `nvdApiKey` (type: `string`):

Your free NVD API key (nvd.nist.gov/developers/request-an-api-key) makes runs ~10x faster (50 instead of 5 requests per 30 s). Not required.

## Actor input object example

```json
{
  "exactPhrase": false,
  "severities": [
    "CRITICAL",
    "HIGH"
  ],
  "publishedFrom": "7 days",
  "onlyKnownExploited": false,
  "onlyNew": false,
  "stateKey": "default",
  "sort": "newest",
  "maxItems": 100,
  "enrichKev": true,
  "enrichEpss": true,
  "maxCpesPerCve": 25,
  "includeRejected": false
}
```

# Actor output Schema

## `results` (type: `string`):

One row per CVE: description, CVSS score/severity/vector, CWE, affected vendors/products/CPEs, KEV status, EPSS, priority, references.

## `summary` (type: `string`):

NVD queries, matching CVEs, CVEs saved, filtered and already-seen counts.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "severities": [
        "CRITICAL",
        "HIGH"
    ],
    "publishedFrom": "7 days",
    "maxItems": 100
};

// Run the Actor and wait for it to finish
const run = await client.actor("manageable_gully/cve-vulnerability-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "severities": [
        "CRITICAL",
        "HIGH",
    ],
    "publishedFrom": "7 days",
    "maxItems": 100,
}

# Run the Actor and wait for it to finish
run = client.actor("manageable_gully/cve-vulnerability-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "severities": [
    "CRITICAL",
    "HIGH"
  ],
  "publishedFrom": "7 days",
  "maxItems": 100
}' |
apify call manageable_gully/cve-vulnerability-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,manageable_gully/cve-vulnerability-scraper"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/qVs2qFla34vjIWFxe/builds/MdkfeHpMvrgK23ZZY/openapi.json