CVE Vulnerability Lookup — Check Software CVEs by Name and Version

Look up known vulnerabilities (CVEs) for software by name and version. Query the official NIST NVD database to get CVSS scores, severity ratings, published dates, and remediation information for any software package.

---

What does it do?

CVE Vulnerability Lookup queries the National Vulnerability Database (NVD) maintained by NIST (National Institute of Standards and Technology) and returns all known Common Vulnerabilities and Exposures (CVEs) for a given software name and version combination. For each matching vulnerability, the actor returns the full CVE record including the CVE ID, CVSS v3.1 and v2.0 scores, severity classification (CRITICAL, HIGH, MEDIUM, LOW), attack vector, affected configurations, and any available remediation or patch information.

The actor supports batch processing — you can submit multiple software name and version pairs in a single run and receive a consolidated report across your entire stack, making it ideal for vulnerability scanning at scale.

---

Who is it for?

This actor is designed for:

• DevOps and SRE engineers who need to check their deployment stack for known vulnerabilities before or after deployments.
• Security engineers performing routine vulnerability assessments across internal and external software inventories.
• Penetration testers who need to enumerate known CVEs for technologies discovered during reconnaissance.
• IT asset managers tracking software versions across an organization and assessing exposure to published vulnerabilities.
• CI/CD pipeline architects embedding automated vulnerability checks into build and release workflows.
• Bug bounty hunters researching software targets for known vulnerabilities before investing time in deeper analysis.

---

Why use this?

Authoritative data source. The actor queries the NIST NVD API directly — the same database that governments, enterprises, and security vendors rely on as the single source of truth for published vulnerabilities.

Severity-aware results. Every CVE comes with its CVSS v3.1 base score, vector string, and severity rating (CRITICAL, HIGH, MEDIUM, LOW). You can prioritise patching by severity without parsing raw JSON yourself.

Batch processing for real-world stacks. No one runs a single piece of software. Submit multiple software/version pairs in one call and get a unified vulnerability map across your entire technology stack.

Max results control. Set a cap on how many CVEs to return per software query so you don't get overwhelmed by common libraries with hundreds of entries. Focus on the most severe or most recent vulnerabilities.

JSON output for automation. Results come back as clean, structured JSON ready for ingestion into SIEM systems, dashboards, ticketing platforms, or custom reporting pipelines.

---

Input Parameters

Parameter	Type	Required	Default	Description
software	string	Yes*	—	Single software name to look up (e.g., "openssl", "nginx", "log4j"). Required if hosts is not provided.
version	string	Yes*	—	Version string for the software (e.g., "1.1.1t", "1.24.0", "2.17.1"). Required if software is provided.
maxResults	number	No	50	Maximum number of CVEs to return per query. Set higher for comprehensive audits, lower for quick checks.
batch	array	No	—	Array of {software, version} objects for batch processing. When provided, software and version are ignored.

Either use the software + version fields for a single lookup, or use batch for multiple lookups in one run.

---

Example Input

Single software lookup:

{
  "software": "openssl",
  "version": "1.1.1t",
  "maxResults": 10
}

Batch mode for multiple software packages:

{
  "maxResults": 20,
  "batch": [
    { "software": "openssl", "version": "1.1.1t" },
    { "software": "nginx", "version": "1.24.0" },
    { "software": "log4j", "version": "2.17.1" },
    { "software": "curl", "version": "7.88.1" },
    { "software": "libssh2", "version": "1.10.0" }
  ]
}

---

Output Structure

Each run returns a JSON object with an array of results. Each result in the array contains:

Field	Type	Description
software	string	The software name queried
version	string	The version string queried
cveCount	number	Total number of CVEs found
vulnerabilities	array	Array of CVE objects
vulnerabilities[].cveId	string	CVE identifier (e.g., CVE-2023-XXXX)
vulnerabilities[].description	string	Brief description of the vulnerability
vulnerabilities[].publishedDate	string	ISO 8601 publication date
vulnerabilities[].lastModifiedDate	string	ISO 8601 last modification date
vulnerabilities[].cvssV3Score	number	CVSS v3.1 base score (0.0–10.0)
vulnerabilities[].cvssV3Severity	string	Severity: CRITICAL, HIGH, MEDIUM, or LOW
vulnerabilities[].cvssV3Vector	string	CVSS v3.1 vector string
vulnerabilities[].cvssV2Score	number	CVSS v2.0 base score (0.0–10.0)
vulnerabilities[].cvssV2Severity	string	Legacy severity rating
vulnerabilities[].attackVector	string	Attack vector (NETWORK, ADJACENT, LOCAL, PHYSICAL)
vulnerabilities[].attackComplexity	string	Attack complexity (LOW, HIGH)
vulnerabilities[].privilegesRequired	string	Privileges required (NONE, LOW, HIGH)
vulnerabilities[].userInteraction	string	User interaction required (NONE, REQUIRED)
vulnerabilities[].scope	string	Impact scope (UNCHANGED, CHANGED)
vulnerabilities[].confidentialityImpact	string	Confidentiality impact (NONE, LOW, HIGH)
vulnerabilities[].integrityImpact	string	Integrity impact (NONE, LOW, HIGH)
vulnerabilities[].availabilityImpact	string	Availability impact (NONE, LOW, HIGH)
vulnerabilities[].weaknesses	array	CWE weakness identifiers
vulnerabilities[].references	array	URLs to advisories, patches, and vendor bulletins
error	string	Error message if the lookup failed for a particular entry

---

Example Output

{
  "results": [
    {
      "software": "openssl",
      "version": "1.1.1t",
      "cveCount": 2,
      "vulnerabilities": [
        {
          "cveId": "CVE-2023-5363",
          "description": "Issue in determining the validity of a certificate chain when the X509_V_FLAG_X509_STRICT flag is set.",
          "publishedDate": "2023-10-10T00:00:00.000Z",
          "lastModifiedDate": "2023-10-16T14:00:00.000Z",
          "cvssV3Score": 7.5,
          "cvssV3Severity": "HIGH",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH",
          "weaknesses": [
            "CWE-295"
          ],
          "references": [
            "https://security.netapp.com/advisory/ntap-20231027-0002/",
            "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0f0a8a4f7c6c1c8d5b20e1a7b0a4c0b9a1f2e3d4"
          ]
        }
      ]
    }
  ]
}

---

API Usage

cURL

# Single software lookup
curl -X POST "https://api.apify.com/v2/acts/perryay~cve-vulnerability-lookup/runs" \
  -H "Content-Type: application/json" \
  -d '{
    "software": "openssl",
    "version": "1.1.1t",
    "maxResults": 10
  }'

# Batch lookup for multiple software packages
curl -X POST "https://api.apify.com/v2/acts/perryay~cve-vulnerability-lookup/runs" \
  -H "Content-Type: application/json" \
  -d '{
    "maxResults": 20,
    "batch": [
      { "software": "openssl", "version": "1.1.1t" },
      { "software": "nginx", "version": "1.24.0" },
      { "software": "log4j", "version": "2.17.1" }
    ]
  }'

Python

import requests
import json

API_TOKEN = "YOUR_API_TOKEN"
ACTOR_ID = "perryay~cve-vulnerability-lookup"

# Single software lookup
payload = {
    "software": "openssl",
    "version": "1.1.1t",
    "maxResults": 10
}

response = requests.post(
    f"https://api.apify.com/v2/acts/{ACTOR_ID}/runs",
    params={"token": API_TOKEN},
    json=payload
)

result = response.json()
print(f"Found {result['results'][0]['cveCount']} CVEs")

# Display critical and high severity vulnerabilities
for vuln in result['results'][0]['vulnerabilities']:
    if vuln['cvssV3Severity'] in ('CRITICAL', 'HIGH'):
        print(f"{vuln['cveId']} - {vuln['cvssV3Severity']} ({vuln['cvssV3Score']}): {vuln['description'][:80]}...")

# Batch mode
batch_payload = {
    "maxResults": 20,
    "batch": [
        {"software": "openssl", "version": "1.1.1t"},
        {"software": "nginx", "version": "1.24.0"},
        {"software": "log4j", "version": "2.17.1"}
    ]
}

response = requests.post(
    f"https://api.apify.com/v2/acts/{ACTOR_ID}/runs",
    params={"token": API_TOKEN},
    json=batch_payload
)

results = response.json()
for entry in results['results']:
    print(f"{entry['software']} {entry['version']}: {entry['cveCount']} CVEs found")
    for vuln in entry['vulnerabilities']:
        if vuln['cvssV3Severity'] == 'CRITICAL':
            print(f"  ⚠ {vuln['cveId']} - CVSS {vuln['cvssV3Score']}")

---

Use Cases

Pre-deployment vulnerability scanning

Before promoting a build to production, run your full dependency list through CVE Vulnerability Lookup. Catch known vulnerabilities in libraries like OpenSSL, libcurl, or Log4j before they reach your live environment. Integrate the actor into your CI/CD pipeline as a gating step — reject builds that introduce critical-severity dependencies.

Software inventory audits

Map vulnerabilities across your entire software portfolio. Export the results to a spreadsheet, dashboard, or ticketing system to track which teams need to patch what, by when. Generate severity-ranked remediation lists for weekly security reviews.

Vendor risk assessment

When evaluating third-party software or open-source dependencies, run their versions through this actor before committing to integration. Get an immediate picture of the known vulnerability burden any new dependency carries.

Incident response enrichment

When an incident is triggered, use the actor to quickly check whether the affected software has other known vulnerabilities at the current version level. Understanding the full CVE profile of compromised software helps incident responders assess blast radius and prioritise containment.

Regulatory compliance reporting

For compliance frameworks requiring demonstrated awareness of published vulnerabilities (PCI DSS, SOC 2, ISO 27001), use the actor to generate periodic reports showing which software versions have been checked and what vulnerabilities were found. Maintain an audit trail of vulnerability assessments.

---

FAQ

Q: How fresh is the vulnerability data?

The actor queries the NIST NVD API in real time. As soon as NIST publishes or updates a CVE record, it becomes available through this actor. There is no intermediary cache or sync delay.

Q: Can I use this for commercial software?

Yes. CVE records cover both open-source and commercial software. If a vendor has a CVE assigned for a product, and NVD indexes it, the actor will find it.

Q: What if the software name doesn't match exactly?

CVE records use vendor-specific product names. If you get zero results, try variations of the name (e.g., "windows_10" vs "Windows 10", "mysql" vs "mariadb"). The actor searches against the NVD CPE (Common Platform Enumeration) dictionary, so using CPE-compatible names improves accuracy.

Q: Is there a rate limit?

The actor handles NVD API rate limits internally with retry logic and backoff. For very large batch operations, it paces queries to avoid hitting upstream limits.

Q: Does this actor search for CVEs in all states (RESERVED, REJECTED, etc.)?

No. The actor returns only published, actively-assigned CVEs. Rejected, reserved, or withdrawn CVE records are filtered out to keep results actionable.

Q: What is the difference between CVSS v3.1 and v2.0 scores?

CVSS v3.1 is the current industry standard. The actor returns both for compatibility, but severity decisions should be based on the v3.1 score. v2.0 is included for legacy reporting requirements.

---

Related Tools

• Port Scanner — Identify open ports and running services; cross-reference discovered services with this CVE lookup tool.
• SSL Certificate Checker — Validate certificate chains for HTTPS services found during a port scan, then query CVEs for the TLS library versions in use.
• Tech Version CVE Checker — Batch CVE lookup specifically designed for your full technology stack manifest.
• CSP Analyzer — Check Content-Security-Policy headers on web applications discovered during reconnaissance.

---

🔗 More from perryay

Explore the full suite of developer tools on the Apify Store:

• JSON Studio — Format, validate, transform, and diff JSON data with 8 operation modes
• QR Craft — Generate high-quality QR codes in PNG or SVG, batch up to 50
• UUID Lab — Generate UUID v4/v7, NanoID, Short ID, and ULID identifiers
• Domain Intel — WHOIS, DNS, and SSL lookup for any domain
• Meta Mate — Extract Open Graph, Twitter Cards, and JSON-LD metadata
• IP Geo — Multi-provider IP geolocation with ISP detection
• URL Health — Check URL accessibility, redirects, and SSL health
• PW Forge — Generate secure passwords with entropy calculation
• TZ Mate — Convert timezones and check DST offsets
• Regex Lab — Test and debug regular expressions online
• Brand Monitor Lite — Track brand mentions across multiple URLs
• Link Quality Analyzer — Detect broken links and audit link quality
• Mock Data Generator — Generate realistic test data for development
• HTML to Markdown — Convert web pages or HTML to clean Markdown
• SSL Cert Inspector — Deep SSL/TLS certificate analysis with scoring

---

SEO Keywords

CVE lookup, vulnerability database, NIST NVD, security scanner, software vulnerability checker, CVE API, dependency vulnerability scan, open-source vulnerability checker, CVSS score checker, batch vulnerability scanning, supply chain security, zero-day lookup, patch management, vulnerability assessment, security audit tool, CPE lookup, software composition analysis