NVD CVE Change History Scraper

The audit trail of the National Vulnerability Database. This actor scrapes the NVD CVE change history API and returns one row per change event — who changed what on a CVE and when: re-analysis, rejection, CVSS re-scoring, CWE remaps, reference edits, SSVC additions and more.

No API key required. ~$0.5 per 1,000 change events.

What makes this different from my other CVE actors

This is not another "current state of a CVE" scraper. It is the change/audit history — the log of modifications over a CVE's lifetime.

Actor	What it gives you
circl-cve-scraper	The current CVE record (description, CVSS, references) from CIRCL
nist-cpe-scraper	CPE product/platform dictionary entries
cisa-kev-scraper	CISA Known Exploited Vulnerabilities catalog
epss-scores-scraper	EPSS exploit-probability scores
nvd-cve-history-scraper (this one)	The change log: every modification event on a CVE (re-analysis, rejection, CVSS change) with old vs. new values

If you want the current state of a CVE, use one of the others. If you want to know how a CVE record has changed over time — for audit trails, compliance evidence, or catching silently re-scored vulnerabilities — this is the one.

Modes

• window — every change event inside a date range (default = the last 7 days).
• cves — the full change history for one or more specific CVE ids (e.g. Log4Shell CVE-2021-44228).

Use cases

• Vulnerability-management audit trails — a defensible log of when and how a CVE record changed.
• CVE lifecycle tracking — follow a CVE from Received → Initial Analysis → Modified → Reanalysis.
• Detecting re-scored CVEs — flag CVEs whose CVSS was quietly raised or lowered (affects_cvss).
• Compliance — evidence that your triage reflects the latest NVD analysis.

Input

Field	Type	Description
mode	select	window (date range, default) or cves (history for specific ids).
cves	array	CVE ids to fetch when mode = cves, e.g. ["CVE-2021-44228"].
changeStartDate	string	Window start YYYY-MM-DD (UTC). Default = 7 days ago.
changeEndDate	string	Window end YYYY-MM-DD (UTC). Default = now.
eventNameFilter	string	Keep only events with this exact name, e.g. CVE Rejected.
apiKey	string	Optional NVD key — raises the rate limit.
maxItems	integer	Max change events for the run (default 200, max 5000).

Output

One dataset row per change event:

{
  "type": "cve_change",
  "cve_id": "CVE-2021-44228",
  "change_id": "4485E73F-35C2-4A94-82B4-D644383FDC73",
  "event_name": "Reanalysis",
  "source_identifier": "nvd@nist.gov",
  "created": "2021-12-14T19:15:00.000000Z",
  "detail_count": 2,
  "changes": [
    {"action": "Changed", "type": "CVSS V3.1", "old_value": "...", "new_value": "..."}
  ],
  "changed_fields": ["CVSS V3.1", "CWE"],
  "is_rejection": false,
  "is_reanalysis": true,
  "affects_cvss": true,
  "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "source": "nvd-cvehistory",
  "scraped_at": "2026-08-11T00:00:00.000000Z"
}

Event names you will see include: New CVE Received, Initial Analysis, CVE Modified, Modified Analysis, Reanalysis, CVE Rejected, CWE Remap, CPE Deprecation Remap. Detail type values include Description, CVSS V2, CVSS V3.1, CWE, Reference, Affected, CPE Configuration, SSVC.

Rate limits & the 120-day window cap

• Keyless: NVD allows roughly 5 requests per 30 seconds. The actor spaces requests ~6s apart and backs off on HTTP 403/429. Supplying a free NVD apiKey raises the limit and speeds up large runs.
• 120-day window cap: NVD rejects change windows longer than 120 days. The actor automatically splits longer ranges into 120-day chunks, so you can request any span.

Notes

Values for each field-level change are capped at 300 characters and the per-event changes list is capped at 30 entries to keep rows lightweight; detail_count and changed_fields always reflect the full set.