Vulnerability & Security Intel Scraper

Vulnerability & Security Intel Scraper

Aggregate vulnerability and security intelligence from GHSA, MITRE, Exploit-DB, OpenSSF Scorecard, and URLhaus in one run. Each result includes CVE IDs, severity scores, exploit availability, and package or URL indicators. No API keys required. Export to CSV, JSON, Excel, or XML.

Security teams spend hours jumping between the National Vulnerability Database, GitHub Advisories, Exploit-DB, and threat intel feeds to answer one question: is this CVE or dependency dangerous right now. This actor queries five sources in parallel, normalizes the results, and returns a single dataset you can filter and export. It covers CVEs, exploits, malware URLs, and OpenSSF Scorecard metrics for your own repositories.

Who uses it	What they scrape Vulnerability & Security Intel Aggregator for
SOC analysts	Triage the latest CVEs against active exploit and malware intelligence in one query.
Application security engineers	Audit internal repositories with OpenSSF Scorecard and cross-reference dependencies against known vulnerabilities.
Threat researchers	Monitor new exploit publications and malicious URL submissions for a specific product or keyword.
Compliance teams	Generate a snapshot of vulnerability exposure across your software supply chain for audit evidence.

What it does

This Actor collects vulnerability records, exploit entries, malware URLs, and OpenSSF Scorecard results by CVE ID, keyword, or repository URL, and returns each finding as a flat row.

• 🛡️ Multi-source aggregation: GHSA, MITRE CVE, Exploit-DB, OpenSSF Scorecard, and URLhaus queried in parallel.
• 🔍 CVE and keyword search: Drive the actor with a CVE ID like CVE-2024-1234 or a product keyword like 'log4j'.
• 📊 OpenSSF Scorecard: Supply a list of GitHub repository URLs and receive their security posture scores.
• 🌐 Malware URL intelligence: Pull the latest malicious URLs from URLhaus for domain or IP indicators.
• ⚙️ Configurable volume: Set a maximum items limit from 1 up to 1,000,000 per run.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with Vulnerability & Security Intel Aggregator data

🚨 Triage a critical CVE.

A SOC analyst enters a new CVE ID and immediately sees the GHSA advisory, any public exploits, and whether the vulnerability appears in active malware campaigns.

📋 Audit repository security posture.

An AppSec engineer runs a list of internal GitHub repositories through OpenSSF Scorecard and cross-references the results with known CVEs for their dependencies.

🔎 Monitor exploit availability for a product.

A threat researcher searches Exploit-DB and URLhaus by a product keyword each morning to catch new attack tooling and malicious infrastructure.

📦 Assess a package before adoption.

A developer checks a third-party library name against GHSA and MITRE to see its vulnerability history before adding it to the project.

Why choose this scraper

	What you get
Normalized schema	CVE, GHSA, exploit, malware, and scorecard data in one consistent format.
No API keys	Reads public feeds directly; no registration or API token required.
Parallel execution	Five sources queried simultaneously for faster collection.
Supply chain visibility	Score your own repos and check dependencies in the same workflow.

How it compares

This actor aggregates five distinct security intelligence sources, while Package Intel focuses on npm and PyPI package metadata with OSV.dev vulnerability signals.

Feature	ParseForge	Package Intel
GHSA advisory data	Yes	Not listed
MITRE CVE records	Yes	Not listed
Exploit-DB entries	Yes	Not listed
OpenSSF Scorecard metrics	Yes	Not listed
URLhaus malware URLs	Yes	Not listed
Package vulnerability signals	Not listed	Yes

Configure the run

Drive the Actor with a CVE ID, a keyword, or a list of GitHub repositories, and set a maximum number of results to control the run size. The Input tab lists every parameter.

A first run with the defaults:

{
 "maxItems": 10
}

A larger pull:

{
 "maxItems": 200
}

Pricing

Pay-per-result: $0.021 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$2.10
1,000 results	$21.00
10,000 results	$210.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the Vulnerability & Security Intel Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to Vulnerability & Security Intel Aggregator through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

$claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/vulnerability-security-intel-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results for my CVE query?

Check that you have selected at least one source that contains CVE records, such as GHSA or MITRE. Also verify the CVE ID format is correct, for example CVE-2024-1234.

The OpenSSF Scorecard source returns an error for my repository.

Ensure the repository URL is public and uses the format 'github.com/owner/repo'. Private repositories and organizations with restricted API access will not return results.

My run is taking a long time.

Querying multiple sources in parallel with a high maximum items value can take time. Reduce the 'Maximum vulnerabilities' number or deselect sources you do not need.

I see duplicate entries in my dataset.

The same vulnerability can appear across multiple sources. The actor returns each source's record separately so you can compare them. Use a deduplication step in your downstream processing if needed.

The URLhaus source returns data but my keyword filter did not seem to apply.

The keyword filter is applied to GHSA, MITRE, and Exploit-DB. URLhaus returns its most recent submissions unfiltered by keyword. Filter the dataset after the run for URLhaus-specific terms.

FAQ

Question	Answer
Which sources does this actor query?	It queries GitHub Security Advisories (GHSA), the MITRE CVE List, Exploit-DB, the OpenSSF Scorecard API, and URLhaus by abuse.ch. You select which sources to include in each run.
Do I need API keys for any of these sources?	No. All five sources are accessed through their public interfaces. No registration, API key, or authentication is required.
Can I search by something other than a CVE ID?	Yes. The query field accepts any keyword. It is applied to the sources that support free-text search: GHSA, MITRE, and Exploit-DB.
How do I get OpenSSF Scorecard results for my own repositories?	Add your repository URLs to the OpenSSF Repos input field. The actor queries the OpenSSF Scorecard API for each one and returns the scores and checks.
What does the URLhaus source return?	It returns the most recent malicious URL submissions, including the URL, threat type, tags, and the date it was reported.
How many results can I collect in one run?	You set the maximum with the 'Maximum vulnerabilities' field. The allowed range is 1 to 1,000,000 items.
What output formats are supported?	You can export your dataset to CSV, JSON, Excel, or XML from the Apify platform.
Does this actor check my own software for vulnerabilities?	It does not scan your code. It collects public vulnerability and threat intelligence data. You can use the OpenSSF Scorecard source to assess the security practices of public GitHub repositories you specify.
Can I schedule this actor to run daily?	Yes. Apify supports scheduled runs. You can configure this actor to collect fresh intelligence on a cron schedule.
Is the data from all sources normalized?	Yes. Each source returns a different shape natively, but the actor maps every result into a single flat schema so you can analyze them together.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by the respective sources (GitHub, MITRE, Exploit-DB, OpenSSF, abuse.ch). It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.