CIRCL CVE Search Scraper

CIRCL CVE Search Scraper

Scrape CVE records from CIRCL's public search API, by latest, CVE ID, vendor, product, CWE, or CAPEC. Each record returns the full vulnerability details, references, CVSS scores, and affected products. No API key. Export to JSON, CSV, Excel, or XML.

CIRCL's CVE search API is the authoritative public source for vulnerability data, but querying it manually means writing your own HTTP client and parsing nested JSON. This Actor wraps every CIRCL CVE search mode into one fixed schema, so you can pull the latest CVEs, look up a single CVE ID, browse a vendor's products, or list CWE and CAPEC entries without writing code.

Who uses it	What they scrape CIRCL CVE Search for
Security analysts	Pull the latest CVEs or a specific CVE ID to triage vulnerabilities in their environment
Threat intelligence teams	Monitor new CVE publications for vendors and products they care about
Compliance officers	Build a complete inventory of CVEs affecting software in their organization
Penetration testers	Look up CWE and CAPEC patterns to understand attack techniques
Researchers	Collect CVE data in bulk for statistical analysis or machine learning

What it does

This Actor queries the CIRCL CVE search API and returns each CVE, vendor, product, CWE, or CAPEC record as a flat row.

• 🆕 Latest CVEs: fetch the most recently published CVEs, up to 1000 per run
• 🔍 Single CVE by ID: get full details for one CVE, or batch lookup multiple CVE IDs in one run
• 🏢 Browse vendor: list every product known to CIRCL for a vendor like apache or microsoft
• 📦 Search vendor + product: return every CVE for a specific vendor/product pair, e.g. apache/log4j
• 🗄️ DB info: get the last database update timestamp to know how fresh the data is
• 🧩 CWE catalogue: list every Common Weakness Enumeration entry
• ⚔️ CAPEC patterns: list CAPEC attack patterns related to a CWE ID
• 📇 Vendors index: list every vendor known to CIRCL

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with CIRCL CVE Search data

🛡️ Monitor new vulnerabilities.

A security analyst runs the latest mode every morning to see which CVEs were published overnight and triage them against their asset inventory.

🔎 Investigate a specific CVE.

An incident responder enters CVE-2021-44228 in byId mode to get the full record, references, and CVSS score for a Log4j investigation.

📋 Build a vendor vulnerability inventory.

A compliance officer uses browseVendor and searchProduct to list every CVE for apache/tomcat and export the list for audit evidence.

🧠 Understand attack techniques.

A penetration tester looks up CAPEC patterns for a CWE ID to see which attack patterns are associated with a weakness class.

📊 Collect data for research.

A researcher runs the latest mode with a high count to gather a large sample of recent CVEs for statistical analysis.

Why choose this scraper

	What you get
No API key	CIRCL's public API needs no registration or authentication
Fixed schema	Every mode returns the same flat row shape, ready for export
Batch lookup	Fetch multiple CVE IDs in a single run with the cveIds array
All CIRCL modes	Latest, byId, browseVendor, searchProduct, dbInfo, cwe, capec, vendor
Export anywhere	JSON, CSV, Excel, or XML, directly from the dataset

How it compares

This Actor covers all CIRCL CVE search modes, while the competitors below focus only on the latest CVE records.

Feature	ParseForge	Circl Cve Last API Scraper	Circl Cve Last Scraper	Circl Cve Last List2 Scraper
Latest CVEs mode	Yes	Yes	Yes	Yes
Single CVE by ID	Yes	Not listed	Not listed	Not listed
Browse vendor products	Yes	Not listed	Not listed	Not listed
Search vendor + product CVEs	Yes	Not listed	Not listed	Not listed
CWE catalogue	Yes	Not listed	Not listed	Not listed
CAPEC patterns	Yes	Not listed	Not listed	Not listed
Batch CVE ID lookup	Yes	Not listed	Not listed	Not listed

Configure the run

Drive the Actor from a mode selector, CVE IDs, vendor and product slugs, and a max items cap, and filters run as each record is read so only matches reach your dataset. The Input tab lists every parameter.

A first run with the defaults:

{
 "mode": "latest",
 "count": 100,
 "maxItems": 10
}

A larger pull:

{
 "mode": "latest",
 "count": 100,
 "maxItems": 200
}

Pricing

Pay-per-result: $0.0325 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$3.25
1,000 results	$32.50
10,000 results	$325.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the CIRCL CVE Search Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to CIRCL CVE Search through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

$claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/circl-cve-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results?

Check that the mode-specific inputs are set correctly. For byId, provide a valid CVE ID like CVE-2021-44228. For browseVendor or searchProduct, use lowercase vendor and product slugs as listed by CIRCL. Run the vendor or browseVendor mode first to find valid slugs.

Why is my run slow?

The CIRCL API can be slow for large queries. Reduce the count or maxItems inputs, or split the work into multiple runs with different filters.

Why do I get an error about invalid CVE ID format?

CVE IDs must follow the format CVE-YYYY-NNNN, for example CVE-2021-44228. Check for typos or missing digits.

Why does the vendor mode return so many results?

The vendor mode lists every vendor known to CIRCL, which is a large list. Use maxItems to limit the output, or switch to browseVendor for a specific vendor.

Why is my dataset missing some fields?

Not all CVE records have every field populated. Missing data appears as null or empty in the output. Check the CIRCL API documentation for field availability.

FAQ

Question	Answer
Do I need an API key to use this Actor?	No. CIRCL's CVE search API is public and requires no authentication. The Actor calls it directly.
What is the difference between the modes?	latest returns the most recent CVEs, byId fetches one or more specific CVE IDs, browseVendor lists products for a vendor, searchProduct returns CVEs for a vendor/product pair, dbInfo gives the last update timestamp, cwe lists CWE entries, capec lists CAPEC patterns for a CWE, and vendor lists all vendors.
Can I fetch multiple CVE IDs in one run?	Yes. Use the cveIds array input to batch lookup multiple CVE IDs in a single byId run. It takes precedence over the single cveId field.
How many CVEs can I get in one run?	The maxItems input caps the total number of CVEs collected per run, up to 1,000,000. The count input for latest mode caps the number of most-recent CVEs fetched, up to 1000.
What format is the vendor and product input?	Use lowercase slugs as used by CIRCL, for example apache for vendor and log4j for product. You can find valid slugs by running browseVendor or vendor modes first.
Does this Actor return CVSS scores?	Yes, each CVE record includes CVSS score information when available, along with references, affected products, and other details.
Can I export the data to Excel?	Yes, the dataset can be exported to JSON, CSV, Excel, or XML from the Apify platform.
How fresh is the CVE data?	CIRCL updates its database regularly. Use the dbInfo mode to get the last update timestamp and confirm freshness before a run.
What is the difference between CWE and CAPEC?	CWE is a catalogue of software weaknesses, while CAPEC is a catalogue of attack patterns. The capec mode lists CAPEC patterns related to a given CWE ID.
Is this Actor suitable for production monitoring?	Yes, you can schedule it on Apify to run at regular intervals and push the latest CVEs to your team or a downstream system.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by CIRCL (Computer Incident Response Center Luxembourg). It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.