NIST CPE Scraper - Software Product Dictionary (No API Key)

Scrape the official NIST CPE dictionary - the canonical list of software and hardware product identifiers maintained inside the National Vulnerability Database (NVD). Every record gives you a machine-readable vendor / product / version identity for a piece of software, an operating system or a device, ready for asset inventory, SBOM enrichment, vulnerability matching and software asset management.

No API key, no login, no proxies required.

What is a CPE?

A CPE (Common Platform Enumeration) is a standardised naming scheme for IT products, written as a 13-part string such as cpe:2.3:a:openssl:openssl:1.1.1w:*:*:*:*:*:*:* - part, vendor, product, version, update, edition, language, sw_edition, target_sw, target_hw, other. Security tooling uses these identifiers as the join key between "what software do I run" and "which advisories apply to it", which is exactly why NVD publishes the dictionary separately from the vulnerability feed.

This is the product dictionary, not a CVE feed

	This Actor	circl-cve-scraper / CVE-style actors
Object	Products (cpe:2.3:a:openssl:openssl:3.0.13)	Vulnerabilities (CVE-2024-XXXX)
Answers	"What is the exact identifier for this software/version?"	"Which flaws affect this software?"
Typical use	Asset inventory, CMDB normalisation, SBOM enrichment	Alerting, patch prioritisation, risk scoring
Key fields	vendor, product, version, part, titles, deprecation	CVE id, CVSS, description, affected ranges

In short: CPE = the noun, CVE = the problem with the noun. You normalise your inventory against this Actor's output, then feed those CPE names into a CVE source to get matches with far fewer false positives than fuzzy name matching.

Modes

Mode	What it does	Input used
search	Keyword queries against titles and CPE names	keywords (e.g. openssl, apache http server)
match	Expands a CPE match string, e.g. a whole vendor namespace	matchStrings (e.g. cpe:2.3:a:microsoft:*)
recent	Everything modified inside the last N days	lastModDays (1-120)

Input

{
  "mode": "search",
  "keywords": ["apache http server", "openssl"],
  "matchStrings": ["cpe:2.3:a:microsoft:*"],
  "lastModDays": 30,
  "includeDeprecated": false,
  "maxItems": 200
}

Field	Type	Default	Description
mode	select	search	search, match or recent
keywords	array	["apache http server","openssl"]	Free-text product queries (search mode)
matchStrings	array	-	CPE 2.3 match strings (match mode)
lastModDays	integer	30	Look-back window, max 120 (recent mode)
includeDeprecated	boolean	false	Keep superseded dictionary entries
maxItems	integer	200	Cap on dataset items, max 5000

Output

One item per CPE product. Every field is nullable.

{
  "cpe_name": "cpe:2.3:a:openssl:openssl:0.9.1c:*:*:*:*:*:*:*",
  "cpe_name_id": "AC31DD13-D8A9-44DD-B735-C2A75C2BF249",
  "part": "a",
  "part_label": "application",
  "vendor": "openssl",
  "product": "openssl",
  "version": "0.9.1c",
  "update": null,
  "edition": null,
  "language": null,
  "sw_edition": null,
  "target_sw": null,
  "target_hw": null,
  "other": null,
  "title": "OpenSSL Project OpenSSL 0.9.1c",
  "all_titles": [{ "lang": "en", "title": "OpenSSL Project OpenSSL 0.9.1c" }],
  "is_deprecated": false,
  "deprecated_by": null,
  "created": "2007-08-23T21:05:57.937Z",
  "last_modified": "2011-01-12T14:35:43.723Z",
  "reference_count": 2,
  "references": [{ "type": "Product", "ref": "https://www.openssl.org/" }],
  "source": "nvd-cpe",
  "scraped_at": "2026-07-28T17:50:28+00:00"
}

Correct CPE parsing (this matters)

• The 13 components are split on unescaped colons only. A naive split(":") corrupts every name containing an escaped colon (foo\:bar, Debian epoch versions like 1\:2.3).
• Escapes are removed for the parsed fields, so xerces-c\+\+ becomes xerces-c++, while cpe_name keeps the original string.
• A component that is * (ANY) or - (NA) is emitted as null, never as the literal "*". An escaped \* stays a literal asterisk.
• part gives the raw letter (a, o, h) and part_label the readable form (application, operating_system, hardware).

Rate limits (important)

The NVD API allows roughly 5 requests per rolling 30 seconds without an API key. This Actor therefore spaces requests 6.5 seconds apart and backs off automatically on HTTP 403/429. A free NVD API key (https://nvd.nist.gov/developers/request-an-api-key) raises that ceiling to about 50 requests per 30 seconds - if you need to mirror large slices of the dictionary regularly, request one and run fewer, larger pages. Each request already pulls up to 2000 products, so the default 200-item run finishes in a single call.

Pricing

Roughly $0.5 per 1,000 products on the Apify platform (pay-per-result), plus the usual platform compute. Runs use 512 MB and no proxy, so cost is dominated by result count.

Use cases

• Asset inventory - normalise messy vendor/product strings from CMDB, MDM or EDR exports into canonical CPE names.
• SBOM enrichment - attach a CPE identity to CycloneDX/SPDX components that only carry a purl or a free-text name.
• Vulnerability matching - use exact CPE names as the join key against CVE feeds instead of fuzzy string matching.
• Software asset management - track version coverage per vendor, spot deprecated identifiers and follow deprecated_by to their replacements.

Related Actors

• circl-cve-scraper - CVE vulnerability records
• software-eol-scraper - end-of-life and support dates
• deps-dev-scraper - open source dependency and package metadata
• ip-threat-intel-scraper - IP reputation and threat intelligence

Notes

• Data source: NVD CPE API 2.0 (services.nvd.nist.gov/rest/json/cpes/2.0), public domain US government data.
• Deprecated entries are excluded by default; enable includeDeprecated to audit legacy identifiers and their replacements.
• The Actor fails with a distinct RATE LIMIT error message if it collected nothing because NVD answered 403/429, so you can tell throttling apart from an empty query.