# CVE Vulnerability API: VulnCheck KEV, Exploits, NVD++ and CPE (`nabeelbaghoor/cve-vulnerability-exploit-intelligence-api`) Actor

CVE vulnerability and exploit intelligence from the VulnCheck API: VulnCheck KEV known exploited vulnerabilities, NVD++ CVSS data, exploit maturity, initial access, EPSS and 31 indexes by CVE or date, plus CVE search and CPE and PURL lookups for SBOM and patch prioritization. Bring your own key.

- **URL**: https://apify.com/nabeelbaghoor/cve-vulnerability-exploit-intelligence-api.md
- **Developed by:** [Nabeel Hassan](https://apify.com/nabeelbaghoor) (community)
- **Categories:** Developer tools, Business, Integrations
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $8.00 / 1,000 vulnerability record returneds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CVE Vulnerability API: VulnCheck KEV, Exploits, NVD++ and CPE

Pull CVE vulnerability and exploit intelligence from the VulnCheck API with your own token, as one clean dataset row per CVE record, search hit, CPE or package.

VulnCheck is a vulnerability and exploit intelligence platform. Its API on api.vulncheck.com serves VulnCheck KEV (known exploited vulnerabilities, a superset of CISA KEV), NVD++ (the NIST NVD 2.0 data with CVSS scores, served reliably), exploit intelligence with exploit maturity, counts and timelines, initial access detection artifacts, EPSS scores, threat actor, ransomware and botnet links, and hundreds of advisory feeds. This actor wraps the documented v3 read routes so you can prioritize patching, enrich vulnerability scanner output, check an SBOM for vulnerable packages, and feed CVE data into SIEM tools, ticketing, BI dashboards, Google Sheets or AI agents. Bring your own API key.

BYOK, not live tested: every route, parameter and field comes from the OpenAPI document VulnCheck serves at api.vulncheck.com/v3/openapi and the docs at docs.vulncheck.com. The routes were probed on 2026-10-25 with an invalid token, and the actor has not been run against a live VulnCheck token.

### What it does

- **Index query**: read any of 31 VulnCheck indexes by CVE ID, alias, threat actor, MITRE ATT\&CK group, ransomware family, botnet, published date or last modified date, following VulnCheck's server side cursor through as many pages as you ask for. VulnCheck KEV is the default.
- **VulnCheck KEV and CISA KEV**: vendor, product, vulnerability name, required action, due date, known ransomware use, CWE IDs, the VulnCheck exploit database (XDB) entries and the public evidence of exploitation.
- **NVD++ (nist-nvd2) and VulnCheck NVD V2**: the NVD 2.0 CVE record with descriptions, CVSS v4.0, v3.1, v3.0 and v2 metrics, weaknesses, references, configurations and VulnCheck's own vulnerable CPEs.
- **Exploit intelligence (exploits index)**: max exploit maturity (weaponized or POC), public, commercial and weaponized exploit flags, exploited by threat actors, ransomware, botnets or honeypots, EPSS, the full exploit list with validation levels and the exploitation timeline. Filter by maturity, validation level, CISA KEV or VulnCheck KEV.
- **CVE search across all indexes**: every document VulnCheck holds on a CVE (advisories, exploits, KEV entries, scoring, vendor data), each with its index name and full source.
- **CPE lookup and CPE search**: the CVEs tied to a CPE string, or to a vendor, product and version, optionally only where that product is the vulnerable component.
- **PURL lookup**: the CVEs and fixed versions of an open source package version (npm, PyPI, Go, Maven, NuGet and the other supported package managers).
- **Index list**: the indexes your token is licensed for, with descriptions and endpoint links.
- **Pay only for results**: empty, malformed and refused lookups are recorded as a free row that says why, never charged.

### How to use it

1. Sign in at vulncheck.com (a free community account reaches VulnCheck KEV, NVD++ and other community data) and create a token at vulncheck.com/settings/tokens. Exploit intelligence, initial access intelligence and most other indexes need a paid VulnCheck subscription.
2. Paste the token into the API token field (or set the DATA_API_KEY secret). It is sent only to api.vulncheck.com in the Authorization header and is removed from everything the actor logs.
3. Pick a mode, add CVE IDs, CPEs or package URLs (or index filters), and start the run. Download the rows as JSON, CSV or Excel, or call the actor from your own code.

A missing or rejected token, an index your plan does not cover or an empty input ends the run cleanly with a status message that says what to change. Tokens unused for 30 days expire on VulnCheck's side.

### Input

| Field | Modes | Description |
| --- | --- | --- |
| `mode` | all | `indexQuery` (default), `cveSearch`, `cpeLookup`, `cpeSearch`, `purlLookup` or `indexList` |
| `index` | Index query | One of 31 indexes, such as `vulncheck-kev`, `nist-nvd2`, `exploits`, `initial-access`, `epss`, `cisa-kev` |
| `cves` | Index query, CVE search | CVE IDs such as CVE-2024-4577, one per line |
| `alias`, `threatActor`, `mitreId`, `ransomware`, `botnet` | Index query | Optional documented filters |
| `pubStartDate`, `pubEndDate`, `lastModStartDate`, `lastModEndDate` | Index query | Optional dates as YYYY-MM-DD |
| `exploitMaturity`, `validationLevels`, `inKev`, `inVcKev` | Index query on `exploits` | Optional exploit filters |
| `sort`, `order` | Index query | `_timestamp` or `date_added`, `asc` or `desc` |
| `cpes` | CPE lookup | CPE strings in v2.3 or v2.2 form |
| `cpePart`, `cpeVendor`, `cpeProduct`, `cpeVersion` | CPE search | CPE fields; set a vendor, a product or both |
| `isVulnerable` | CPE lookup, CPE search | Only CVEs where the CPE itself is vulnerable |
| `purls` | PURL lookup | Package URLs such as pkg:npm/lodash@4.17.20 |
| `maxResults` | all | Most rows to return and charge for |
| `requestsPerMinute` | all | Pacing for calls to VulnCheck (community limit 1,000 a minute) |
| `apiKey` | all | Your VulnCheck API token (secret) |

### Output

Index rows keep every field VulnCheck returns, plus flat columns that are easy to filter: `cve`, `cves`, `title`, `description`, `vendor`, `product`, `published`, `lastModified`, `dateAdded`, `cvssScore`, `cvssSeverity`, `cvssVersion`, `cvssVector`, `epssScore`, `epssPercentile`, `inKev`, `inVcKev`, `exploitMaturity`, `exploitCount` and `reportedExploited`. CVE search rows add `hitId`, `score` and the full source document under `record`. CPE rows carry `cpe`, `cpeStruct`, `cves` and `cveCount`; PURL rows carry `purl`, `purlStruct`, `cves`, `vulnerabilities` and `fixedVersions`. A refused or empty lookup has `found` set to false and a `note` with VulnCheck's own words.

Example VulnCheck KEV row (values from the VulnCheck documentation sample, lists shortened):

```json
{
    "mode": "indexQuery",
    "modeLabel": "Index query",
    "recordType": "indexRecord",
    "index": "vulncheck-kev",
    "query": "CVE-2024-4577",
    "found": true,
    "cve": "CVE-2024-4577",
    "cves": ["CVE-2024-4577"],
    "title": "PHP-CGI OS Command Injection Vulnerability",
    "description": "PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.",
    "vendor": "PHP Group",
    "product": "PHP",
    "dateAdded": "2024-06-07T00:00:00Z",
    "inKev": true,
    "inVcKev": true,
    "exploitCount": 1,
    "reportedExploited": true,
    "vendorProject": "PHP Group",
    "vulnerabilityName": "PHP-CGI OS Command Injection Vulnerability",
    "required_action": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
    "knownRansomwareCampaignUse": "Known",
    "cwes": ["CWE-78"],
    "vulncheck_xdb": [
        { "xdb_id": "081170ce66e7", "xdb_url": "https://vulncheck.com/xdb/081170ce66e7", "date_added": "2024-06-18T13:19:21Z", "exploit_type": "initial-access" }
    ],
    "vulncheck_reported_exploitation": [
        { "url": "https://x.com/Shadowserver/status/1799053497490698548", "date_added": "2024-06-07T00:00:00Z" }
    ],
    "reported_exploited_by_vulncheck_canaries": true,
    "dueDate": "2024-07-03T00:00:00Z",
    "cisa_date_added": "2024-06-12T00:00:00Z",
    "retrievedAt": "2026-10-25T12:00:00.000Z",
    "note": null
}
```

### Pricing

| Event | Price | Charged for |
| --- | --- | --- |
| `vulnerability-record` | 0.008 USD | Each document read from an index |
| `cve-search-hit` | 0.005 USD | Each document found by CVE search |
| `cpe-vulnerabilities` | 0.008 USD | Each CPE returned with its CVEs |
| `package-vulnerabilities` | 0.01 USD | Each package URL returned with its CVEs and fixed versions |
| `index-listed` | 0.005 USD | Each index in the index list |

Empty, malformed and refused lookups are never charged. Your VulnCheck plan is billed separately by VulnCheck.

### FAQ

#### What is the VulnCheck API?

The VulnCheck API is the programmatic interface to VulnCheck's exploit and vulnerability intelligence platform, run by VulnCheck Inc. Version 3 at api.vulncheck.com/v3 exposes hundreds of indexes (VulnCheck KEV, NVD++, exploits, initial access, EPSS, advisories), a cross index CVE search and CPE and PURL vulnerability lookups, all with a Bearer token.

#### Do I need my own VulnCheck token?

Yes. This is a bring your own key actor: it calls VulnCheck with your token, under your plan, its rate limit and its terms. Create a token at vulncheck.com/settings/tokens after signing in.

#### Can I use a free VulnCheck community account?

Yes, for the community data: VulnCheck KEV, NVD++ (nist-nvd2) and the other indexes VulnCheck opens to community users. The Index list mode shows exactly which indexes your token reaches. Exploit intelligence, initial access intelligence and most advisory indexes need a paid subscription, and VulnCheck answers HTTP 402 or 403 for them, which ends the run with a clear message.

#### What is the difference between VulnCheck KEV and CISA KEV?

CISA KEV is the US government catalog of known exploited vulnerabilities. VulnCheck KEV tracks every vulnerability publicly reported as exploited in the wild, usually earlier and with more entries than CISA KEV, and adds the evidence links and exploit database references. Both are indexes here; the `inKev` and `inVcKev` columns show membership.

#### How do I prioritize CVEs for patching?

Query the exploits index with your CVE IDs: `exploitMaturity` (weaponized or POC), `reportedExploited`, `inKev`, `inVcKev`, `epssScore` and `exploitCount` sit side by side in each row. Weaponized, in KEV and a high EPSS score is the strongest signal to patch first.

#### How do I check an SBOM or dependency list for vulnerabilities?

Use PURL lookup with one package URL per dependency, such as pkg:npm/lodash@4.17.20. Each row lists the CVEs and the fixed versions VulnCheck knows for that exact package version. For commercial software use CPE lookup or CPE search instead.

#### How do I sync NVD data incrementally?

Run Index query on nist-nvd2 (or vulncheck-nvd2) with a last modified from date and a high maximum results. The actor follows VulnCheck's cursor through every page. For a full copy of an index, VulnCheck offers offline backups to licensed customers directly; this actor does not download them.

#### What do I pay?

Pay per result: 0.005 USD per CVE search hit or index listing, 0.008 USD per index record or CPE, and 0.01 USD per package lookup. Empty and refused lookups are free. See the pricing table above.

### Keyword map

CVE API, vulnerability API, CVE database API, exploit intelligence API, known exploited vulnerabilities API, KEV API, VulnCheck KEV, CISA KEV, NVD API alternative, NVD++ API, CVSS score lookup, EPSS score API, exploit maturity, weaponized exploit check, initial access intelligence, CPE to CVE lookup, CPE search, PURL vulnerability lookup, SBOM vulnerability scan, open source package vulnerabilities, vulnerability prioritization, patch prioritization, threat actor CVE, ransomware CVE, VulnCheck API, VulnCheck CVE search.

### Routes and verification

Routes taken from VulnCheck's own OpenAPI document (api.vulncheck.com/v3/openapi) and docs: GET /v3/index, /v3/index/{index}, /v3/search/cve, /v3/search/cpe, /v3/cpe and /v3/purl. A probe on 2026-10-25 with an invalid token answered every route, and invented paths too, with 401 {"error":true,"errors":\["unauthorized"]}: VulnCheck checks the token before the route, so the probe confirms the token handling but cannot tell real routes from invented ones. The /v3/backup bulk download routes and the POST routes are deliberately not wrapped.

### Licensing and data use

This actor works only with your own VulnCheck account and token, and every request is made under that token's licence. VulnCheck's Service Terms grant a personal, non sublicensable, non transferable licence and forbid distributing, renting or otherwise transferring the Service or using it for the benefit of a third party outside the terms. Do not republish or resell what you pull here unless your VulnCheck agreement allows it. VulnCheck KEV and NVD++ community data may be used in your own products at no cost with prominent attribution to VulnCheck, as the VulnCheck attribution notices describe. This actor is not affiliated with or endorsed by VulnCheck.

# Actor input Schema

## `mode` (type: `string`):

Index query reads one VulnCheck index (VulnCheck KEV by default) by CVE, date or other filter, following the cursor. CVE search finds every document on a CVE across all indexes your token reaches. CPE lookup and CPE search return the CVEs tied to a product. PURL lookup returns the CVEs and fixed versions of an open source package version. Index list shows the indexes your token is licensed for.

## `index` (type: `string`):

Index query only. The VulnCheck index to read. VulnCheck KEV and NIST NVD 2.0 are open to free community tokens; most other indexes need a paid VulnCheck subscription.

## `cves` (type: `array`):

Index query and CVE search. One CVE ID per line. In Index query each CVE is looked up in the chosen index; leave it empty to browse the index with the filters below. CVE search needs at least one.

## `alias` (type: `string`):

Index query only, optional. A named vulnerability alias such as PrintNightmare or Log4Shell.

## `threatActor` (type: `string`):

Index query only, optional. A threat actor name such as UNC2630, as listed in the threat-actors index.

## `mitreId` (type: `string`):

Index query only, optional. A MITRE ATT\&CK group ID such as G0013.

## `ransomware` (type: `string`):

Index query only, optional. A ransomware family name, as listed in the ransomware index.

## `botnet` (type: `string`):

Index query only, optional. A botnet name such as Fbot, as listed in the botnets index.

## `pubStartDate` (type: `string`):

Index query only, optional. Earliest published date, as YYYY-MM-DD.

## `pubEndDate` (type: `string`):

Index query only, optional. Latest published date, as YYYY-MM-DD.

## `lastModStartDate` (type: `string`):

Index query only, optional. Earliest last modified date (the record \_timestamp), as YYYY-MM-DD. Use it for incremental syncs.

## `lastModEndDate` (type: `string`):

Index query only, optional. Latest last modified date, as YYYY-MM-DD.

## `exploitMaturity` (type: `string`):

Exploits index only, optional. The highest exploit maturity reached for the CVE.

## `validationLevels` (type: `array`):

Exploits index only, optional. Records match when any of their exploits carries one of these levels.

## `inKev` (type: `string`):

Exploits index only, optional. Keep only CVEs that are (true) or are not (false) in the CISA KEV catalog.

## `inVcKev` (type: `string`):

Exploits index only, optional. Keep only CVEs that are (true) or are not (false) in VulnCheck KEV.

## `sort` (type: `string`):

Index query only, optional. The field VulnCheck sorts on.

## `order` (type: `string`):

Index query only, optional. Newest first (desc) is VulnCheck's default on most indexes.

## `cpes` (type: `array`):

CPE lookup only. One CPE per line, in the v2.3 form (cpe:2.3:a:vendor:product:version:...) or the v2.2 form (cpe:/a:vendor:product:version).

## `cpePart` (type: `string`):

CPE search only, optional. Application, operating system or hardware. Empty searches all parts.

## `cpeVendor` (type: `string`):

CPE search only. The vendor as written in CPEs, such as apache or microsoft. Set a vendor, a product or both.

## `cpeProduct` (type: `string`):

CPE search only. The product as written in CPEs, with underscores for spaces, such as log4j or internet_explorer.

## `cpeVersion` (type: `string`):

CPE search only, optional. An exact version such as 2.14.1, or a trailing wildcard such as 2.14.\*.

## `isVulnerable` (type: `boolean`):

CPE lookup and CPE search. When on, only CVEs where this CPE is the vulnerable component come back, not every CVE whose configuration mentions it.

## `purls` (type: `array`):

PURL lookup only. One package URL per line, such as pkg:npm/lodash@4.17.20, pkg:pypi/django@3.2.0 or pkg:golang/github.com/gin-gonic/gin@v1.6.0.

## `maxResults` (type: `integer`):

The most rows this run returns and charges for. Index queries and CVE searches page through VulnCheck until this is reached.

## `requestsPerMinute` (type: `integer`):

Pacing for calls to VulnCheck. Community tokens allow 1,000 requests a minute; throttled calls are retried after the wait VulnCheck asks for.

## `apiKey` (type: `string`):

Your own VulnCheck API token, created at vulncheck.com/settings/tokens. Stored as a secret and sent only to api.vulncheck.com in the Authorization header; it is never logged. You can instead set the DATA_API_KEY environment secret.

## Actor input object example

```json
{
  "mode": "indexQuery",
  "index": "vulncheck-kev",
  "cves": [
    "CVE-2024-4577"
  ],
  "isVulnerable": false,
  "maxResults": 100,
  "requestsPerMinute": 600
}
```

# Actor output Schema

## `records` (type: `string`):

One row per vulnerability record, search hit, CPE, package or index the chosen mode returns.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "cves": [
        "CVE-2024-4577"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("nabeelbaghoor/cve-vulnerability-exploit-intelligence-api").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "cves": ["CVE-2024-4577"] }

# Run the Actor and wait for it to finish
run = client.actor("nabeelbaghoor/cve-vulnerability-exploit-intelligence-api").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "cves": [
    "CVE-2024-4577"
  ]
}' |
apify call nabeelbaghoor/cve-vulnerability-exploit-intelligence-api --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,nabeelbaghoor/cve-vulnerability-exploit-intelligence-api"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/BRgu7T5tackavEZvx/builds/az1JBAiFgY4WDy0ff/openapi.json