NIST NVD CVE Scraper

NIST NVD CVE Scraper

Scrape CVE vulnerability data from the NIST National Vulnerability Database by keyword, severity, CWE, date range, or CISA KEV status. Each CVE returns its full description, CVSS scores, affected products, weaknesses, and references. No API key required. Export to JSON, CSV, Excel, or XML.

The NIST NVD REST API requires a multi-step request flow, strict date-range windows, and pagination logic that complicates bulk collection. This Actor reads the public NVD CVE feeds directly, filtering by CVSS severity, CWE weakness, CISA KEV catalog membership, CPE product string, or free-text keyword, and returns each matching CVE in one flat schema. It handles the API pagination and rate limits for you, so a single run can collect up to a million CVEs.

Who uses it	What they scrape NIST NVD for
Security operations teams	Pull the latest critical and high-severity CVEs each morning to prioritize patching.
Threat intelligence analysts	Search for CVEs by keyword or CWE to map a new exploit technique to known vulnerabilities.
DevSecOps engineers	Filter CVEs by CPE match string to find every vulnerability affecting a specific software stack.
Compliance auditors	Collect CVEs with CERT alerts or CISA KEV entries to verify remediation against regulatory mandates.

What it does

This Actor collects CVE records from the NIST National Vulnerability Database by keyword search, CVE ID lookup, or filtered date range, and returns each vulnerability as a flat row with its CVSS scores, CWE weaknesses, affected product CPEs, and reference URLs.

• 🎯 Single or batch CVE lookup: fetch one CVE by ID or a list of up to 100 CVE IDs in a single run.
• 🔍 Keyword search: free-text search across CVE descriptions for terms like 'log4j', 'openssl', or 'remote code execution'.
• ⚠️ Severity filter: restrict results to CRITICAL, HIGH, MEDIUM, or LOW CVSS v3 base severity.
• 🛡️ CISA KEV and CERT filters: return only CVEs listed in the CISA Known Exploited Vulnerabilities catalog or referenced in US-CERT alerts and notes.
• 📦 CPE product matching: supply a CPE 2.3 match string to find every CVE affecting a given product or vendor.
• 🗑️ Rejected CVE exclusion: skip REJECTED CVEs that lack scoring data, keeping your dataset clean by default.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with NIST NVD data

📋 Build a vulnerability watchlist.

A SOC analyst runs the Actor daily with severity set to CRITICAL and pubStartDate set to the previous day, then loads the CSV into a SIEM dashboard to flag new threats.

🔎 Investigate a CWE weakness class.

A penetration tester sets the CWE filter to CWE-89 and a keyword of a target product name to collect every SQL injection CVE that might apply to an engagement.

📦 Audit a software supply chain.

A DevSecOps engineer supplies a CPE match string for a web framework and a date range covering the last quarter, then exports the results to track unpatched dependencies.

🛡️ Prioritize actively exploited vulnerabilities.

A vulnerability management lead enables the CISA KEV filter to pull only CVEs with known exploitation activity, feeding the list directly into a patch prioritization meeting.

Why choose this scraper

	What you get
No API key	Reads the public NVD API with no registration, no app setup, and no API key.
Flat output schema	Every CVE returns the same fields: CVE ID, description, CVSS v2/v3 scores, CWE IDs, CPE strings, references, and KEV/CERT flags.
Date-range handling	Automatically splits long date windows into the 120-day chunks the NVD API requires.
Up to 1M CVEs per run	Collect as many as a million CVEs in a single run, with automatic pagination and rate-limit handling.

How it compares

Three other Apify actors also scrape the NIST NVD. This one combines single-ID lookup, batch-ID lookup, keyword search, and the full set of NVD API filters in one input schema.

Feature	ParseForge	NVD CVE Scraper - Vulnerability Database API	NIST NVD MCP Server	NVD Critical CVE & KEV Vulnerability API
Single CVE ID lookup	Yes	Not listed	Not listed	Yes
Batch CVE ID lookup	Yes	Not listed	Not listed	Not listed
Keyword search across descriptions	Yes	Yes	Not listed	Not listed
CISA KEV catalog filter	Yes	Not listed	Not listed	Yes
CWE weakness ID filter	Yes	Not listed	Not listed	Yes
CPE product match string filter	Yes	Not listed	Yes	Not listed
CERT alert and note filters	Yes	Not listed	Not listed	Not listed

Configure the run

Drive the Actor from a single CVE ID, a batch of CVE IDs, a keyword search, or a date range with severity and CWE filters, and each filter runs as the NVD API is queried so only matching CVEs reach your dataset. The Input tab lists every parameter.

A first run with the defaults:

{
  "maxItems": 10
}

A larger pull:

{
  "maxItems": 200
}

Pricing

Pay-per-result: $0.03 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$3.00
1,000 results	$30.00
10,000 results	$300.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the NIST NVD CVE Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to NIST NVD through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

$claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/nist-nvd-cve-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results?

Check that your date range is valid and that both pubStartDate and pubEndDate are set when using date filters. If you set a severity filter, try clearing it to see if results exist at other severity levels. Also confirm that the Exclude Rejected CVEs option is not removing all matches.

Why does the Actor return fewer CVEs than my maxItems setting?

The NVD API returns only CVEs that match your filters. If the total matching count is smaller than your maxItems value, the Actor will return all available matches and stop. Try broadening your date range or removing restrictive filters.

Why is my date-range search failing?

The NVD API requires both pubStartDate and pubEndDate in ISO 8601 format, and the window cannot exceed 120 days. The Actor splits longer windows automatically, but both fields must be populated for any date-based search to work.

Why are some CVEs missing CVSS scores?

Newly published CVEs are sometimes in a RESERVED or ANALYZING state and have not yet received a CVSS score from NIST. These CVEs will appear in results but with empty score fields. Waiting a few days usually resolves this.

My batch CVE ID lookup is slow.

The Actor fetches batch CVE IDs sequentially from the NVD API. For lists larger than about 100 IDs, consider splitting them across multiple runs or using a keyword or date-range search instead.

FAQ

Question	Answer
Do I need an NVD API key to use this Actor?	No. This Actor reads the public NIST NVD REST API endpoints, which do not require an API key or registration. The Actor handles rate limits and pagination internally.
How many CVEs can I collect in one run?	You can set the maximum up to 1,000,000 CVEs per run. The Actor paginates through the NVD API automatically, respecting the service's rate limits.
What date range can I search?	The NVD API requires both a start and end date and enforces a maximum 120-day window per request. The Actor splits longer ranges into compliant chunks automatically.
Can I search by CVE ID?	Yes. Use the single CVE ID field for one lookup, or the batch CVE IDs array to fetch up to about 100 CVEs in one run. When a CVE ID is supplied, all other filters are ignored.
What is the CISA KEV filter?	CISA maintains a catalog of Known Exploited Vulnerabilities, CVEs with confirmed active exploitation. Enable the KEV filter to return only CVEs that appear in that catalog.
Does this Actor return CVSS v2 and v3 scores?	Yes. Each CVE record includes both CVSS v2 and CVSS v3 base scores, severity labels, and vector strings when the NVD has published them.
Can I filter by affected product?	Yes. Supply a CPE 2.3 match string in the Virtual Match String field to return only CVEs whose affected-product CPEs match that string.
What are REJECTED CVEs and why exclude them?	REJECTED CVEs are duplicates or withdrawn entries that typically lack CVSS scores and meaningful descriptions. The Actor excludes them by default to keep your dataset clean.
Can I search by CWE weakness type?	Yes. The CWE ID filter accepts values like CWE-79, CWE-89, or CWE-787 and returns only CVEs tagged with that weakness.
What export formats are supported?	You can export your dataset to JSON, CSV, Excel, or XML from the Apify platform after the run completes.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by National Institute of Standards and Technology. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.