# Technology Version CVE Checker 📋 (`perryay/tech-version-cve-checker`) Actor Batch CVE scanner for your entire technology stack. Check 30+ software packages against the NIST NVD database in a single run. Premium: severe CVE alerts and multi-software scanning. - **URL**: https://apify.com/perryay/tech-version-cve-checker.md - **Developed by:** [Perry AY](https://apify.com/perryay) (community) - **Categories:** Developer tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $0.015 / actor start This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Tech Version CVE Checker — Batch CVE Lookup for Your Technology Stack **Batch CVE lookup for your technology stack. Submit your entire software inventory — frameworks, libraries, languages, databases, servers — and get back a consolidated vulnerability report with CVSS scoring, severity filtering, and structured JSON output ready for CI/CD integration.** --- ### What does it do? Tech Version CVE Checker takes a complete technology stack manifest — an array of software names and their installed versions — and queries the NIST National Vulnerability Database (NVD) for every known CVE affecting each component. It returns a consolidated, severity-ranked vulnerability report covering your entire technology inventory. Unlike a per-component CVE lookup tool, this actor is designed for the specific workflow of scanning a **software bill of materials (SBOM)** or **technology stack manifest**. It accepts your stack as a structured array, performs parallel lookups across all components, and applies CVSS score filters so you see only the vulnerabilities that matter at your chosen threshold. The output is structured for direct ingestion into CI/CD pipelines, SIEM dashboards, and ticketing systems. Built-in score filtering lets you ignore LOW-scoring vulnerabilities and focus on HIGH and CRITICAL findings — the ones that demand immediate attention. --- ### Who is it for? This actor is designed for: - **DevOps and platform engineers** embedding automated vulnerability checks into CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, CircleCI). - **Security engineers** performing regular technology stack audits across development, staging, and production environments. - **SRE teams** maintaining software inventory manifests and needing continuous vulnerability monitoring. - **Compliance officers** generating software composition analysis (SCA) reports for regulatory compliance. - **Engineering managers** tracking vulnerability debt across the organisation's technology portfolio. - **Contractors and consultants** performing technology stack due diligence for client engagements. --- ### Why use this? **Stack-native input format.** Don't search for one piece of software at a time. Submit your full stack as an array and get a consolidated report in one API call. The input format maps directly to your existing software inventory — package.json, requirements.txt, go.mod, Gemfile, or Docker image layer analysis output. **CVSS score filtering cuts the noise.** A typical stack may have hundreds of CVEs across all severity levels. Set `minScore` to `7.0` and focus exclusively on HIGH and CRITICAL vulnerabilities that pose genuine risk. Bypass the noise of low-scoring entries that security teams can't action anyway. **CI/CD ready.** The flat JSON dataset is designed for pipeline consumption. Check the `_summary` row for aggregate metrics. The structured format integrates with GitHub Action annotations, GitLab merge request comments, and Slack notifications without custom parsing. **Score-based risk assessment.** Every vulnerability comes with CVSS v3.1 scores, severity ratings, and published dates. The dataset can be sorted and filtered by score, making it easy to prioritise patching based on actual risk rather than publication date. --- ### Input Parameters | Parameter | Type | Required | Default | Description | |-----------|------|----------|---------|-------------| | `stack` | array | Yes | — | Array of software inventory items. Each item must have `software` (string) and `version` (string) fields. | | `minScore` | number | No | `0.0` | Minimum CVSS score threshold (0.0–10.0). CVEs below this score are filtered out. Set to `7.0` to show only HIGH/CRITICAL, `9.0` for CRITICAL only. | | `maxResults` | number | No | `50` | Maximum CVEs to return per software/version combination (hard limit: 200). | --- ### Example Input **Basic stack scan:** ```json { "stack": [ { "software": "openssl", "version": "1.1.1t" }, { "software": "nginx", "version": "1.24.0" }, { "software": "postgresql", "version": "15.3" }, { "software": "node", "version": "18.17.0" }, { "software": "python", "version": "3.11.4" }, { "software": "log4j", "version": "2.17.1" } ] } ```` **High-severity focused scan (CVSS ≥ 7.0):** ```json { "stack": [ { "software": "openssl", "version": "1.1.1w" }, { "software": "nginx", "version": "1.25.0" }, { "software": "redis", "version": "7.2.0" }, { "software": "curl", "version": "8.1.2" } ], "minScore": 7.0, "maxResults": 20 } ``` *** ### 📤 Output Format The actor pushes each CVE as a **flat dataset item** via `Actor.push_data()`. Each vulnerability is an individual row. A final `_summary` row is appended with aggregate statistics. #### CVE item fields | Field | Type | Description | |-------|------|-------------| | `cveId` | string | CVE identifier (e.g. `CVE-2023-5363`) | | `description` | string | English description of the vulnerability (truncated to 500 characters) | | `severity` | string | CVSS base severity: `NONE`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL` | | `cvssScore` | number | CVSS v3.x base score (0.0–10.0) | | `publishedDate` | string | ISO 8601 publication date from NVD | | `software` | string | Software name from the input stack | | `version` | string | Version string from the input stack | #### Summary item fields | Field | Type | Description | |-------|------|-------------| | `_summary` | boolean | Always `true` — distinguishes this row from CVE items | | `total_cves` | number | Total number of CVEs found across all components | | `software_count` | number | Number of software packages scanned | | `has_severe_alerts` | boolean | `true` if any CVE has a CVSS score ≥ 9.0 | | `severity_breakdown` | object | Count of CVEs grouped by severity (e.g. `{"HIGH": 3, "MEDIUM": 8}`) | *** ### Example Output ```json {"cveId":"CVE-2023-5363","description":"Issue in determining the validity of a certificate chain...","severity":"HIGH","cvssScore":7.5,"publishedDate":"2023-10-10T00:00:00.000","software":"openssl","version":"1.1.1t"} {"cveId":"CVE-2023-44487","description":"HTTP/2 rapid reset attack vulnerability...","severity":"HIGH","cvssScore":7.5,"publishedDate":"2023-10-10T00:00:00.000","software":"nginx","version":"1.24.0"} {"cveId":"CVE-2023-1234","description":"Buffer overflow in XYZ parsing...","severity":"MEDIUM","cvssScore":6.1,"publishedDate":"2023-09-15T00:00:00.000","software":"openssl","version":"1.1.1t"} {"_summary":true,"total_cves":3,"software_count":6,"has_severe_alerts":false,"severity_breakdown":{"HIGH":2,"MEDIUM":1}} ``` *Note: The actor pushes one JSON object per line (JSON Lines / NDJSON format). Each line is an individual dataset item. The `_summary` item is always the last row.* *** ### API Usage #### cURL ```bash ## Basic stack scan curl -X POST "https://api.apify.com/v2/acts/perryay~tech-version-cve-checker/runs" \ -H "Content-Type: application/json" \ -d '{ "stack": [ {"software": "openssl", "version": "1.1.1t"}, {"software": "nginx", "version": "1.24.0"}, {"software": "postgresql", "version": "15.3"} ] }' ## High-severity focused scan curl -X POST "https://api.apify.com/v2/acts/perryay~tech-version-cve-checker/runs" \ -H "Content-Type: application/json" \ -d '{ "stack": [ {"software": "openssl", "version": "1.1.1w"}, {"software": "nginx", "version": "1.25.0"}, {"software": "redis", "version": "7.2.0"} ], "minScore": 7.0 }' ``` #### Python ```python import requests import json import sys API_TOKEN = "YOUR_API_TOKEN" ACTOR_ID = "perryay~tech-version-cve-checker" ## Define your technology stack stack = [ {"software": "openssl", "version": "1.1.1t"}, {"software": "nginx", "version": "1.24.0"}, {"software": "postgresql", "version": "15.3"}, {"software": "node", "version": "18.17.0"}, {"software": "python", "version": "3.11.4"}, {"software": "log4j", "version": "2.17.1"}, ] payload = { "stack": stack, "minScore": 7.0, } response = requests.post( f"https://api.apify.com/v2/acts/{ACTOR_ID}/runs", params={"token": API_TOKEN}, json=payload ) ## Output is JSON Lines — each line is a dataset item run_data = response.json() print(f"Stack scan completed. Check your dataset for results.") ``` *** ### Use Cases #### CI/CD vulnerability gate Integrate the actor into your CI/CD pipeline as a deployment gating step. Whenever a build is triggered, the pipeline runs the current software stack through Tech Version CVE Checker. If any CVE exceeds your configured CVSS score threshold, the build is stopped or flagged for review. This prevents deploying known-vulnerable software into production. #### Monthly stack audit Schedule a recurring scan of your full technology stack — production, staging, and development environments. Generate a severity-ranked report and distribute it to the engineering teams responsible for each component. Track vulnerability debt over time: are you reducing your CVE count or accumulating it? #### SBOM analysis If your organisation generates Software Bill of Materials (SBOM) documents in SPDX or CycloneDX format, parse the SBOM to extract software names and versions, then submit the list to Tech Version CVE Checker. This gives you a vulnerability-annotated SBOM for compliance reporting. #### Dependency upgrade planning Before planning a major dependency upgrade cycle, run your current stack through the checker to identify which components have the most severe vulnerabilities. Prioritise upgrades based on actual risk rather than arbitrary schedules. After upgrading, re-run the checker to confirm the vulnerabilities are resolved. #### M\&A technology due diligence When evaluating a target company's technology stack, run their disclosed software inventory through the checker. Get an immediate picture of the vulnerability burden you would inherit. Use the results to inform risk assessment, integration planning, and remediation budgeting. #### Container image vulnerability reporting Extract software versions from your container images (using tools like Trivy, Grype, or Docker Scout) and feed the results into Tech Version CVE Checker for a consolidated NVD-based vulnerability view that supplements your container scanner's findings. *** ### FAQ **Q: How is this different from the CVE Vulnerability Lookup actor?** Tech Version CVE Checker is designed specifically for scanning **multiple software components as a batch** — your full technology stack. It accepts a `stack` array rather than individual software/version pairs, provides CVSS score filtering, and returns a `_summary` row with aggregate statistics. CVE Vulnerability Lookup is better suited for ad-hoc single-software queries. **Q: Can I use this in a GitHub Action?** Yes. The JSON Lines output is easy to parse in any CI runner. Each line is a complete JSON object, and the `_summary` row (always last) gives you aggregate metrics for pass/fail decisioning. **Q: What minScore threshold should I set for CI/CD gating?** Most teams start with `7.0` — this catches HIGH and CRITICAL vulnerabilities that genuinely matter without blocking deployments for every low-scoring finding. As your security maturity increases, you may move toward `4.0` (MEDIUM+) or keep `7.0` and add a review requirement for MEDIUM findings. **Q: How many components can I check in a single run?** The actor supports stacks of up to 30 components. This covers the vast majority of real-world technology stacks. **Q: What if one of my components isn't found in the NVD?** Components that are not indexed in the NVD return zero CVEs. This is common for very niche or proprietary software. **Q: What CVE data freshness can I expect?** The actor queries the NIST NVD API in real-time. CVEs are available as soon as NIST publishes them. There is no intermediate cache — every run hits the authoritative source. **Q: Can I export the results to a CSV or dashboard?** The JSON Lines output is compatible with any JSON-to-CSV converter, and its flat structure maps naturally to data visualisation tools like Grafana, Datadog, or custom dashboards. The `_summary` row provides ready-to-use aggregate metrics for dashboard ingestion. # Actor input Schema ## `stack` (type: `array`): Array of {software, version} objects representing your technology stack (up to 30 packages per run) ## `minScore` (type: `number`): Minimum CVSS score to include (0.0-10.0) ## `maxResults` (type: `integer`): Maximum CVE results per software package (1-200) ## Actor input object example ```json { "stack": [ { "software": "nginx", "version": "1.24.0" }, { "software": "openssl", "version": "3.0.12" }, { "software": "python", "version": "3.11.0" } ], "minScore": 0, "maxResults": 50 } ``` # Actor output Schema ## `results` (type: `string`): Results in the default dataset — one item per operation. Access via API or Apify Console. # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "stack": [ { "software": "nginx", "version": "1.24.0" }, { "software": "openssl", "version": "3.0.12" }, { "software": "python", "version": "3.11.0" } ] }; // Run the Actor and wait for it to finish const run = await client.actor("perryay/tech-version-cve-checker").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "stack": [ { "software": "nginx", "version": "1.24.0", }, { "software": "openssl", "version": "3.0.12", }, { "software": "python", "version": "3.11.0", }, ] } # Run the Actor and wait for it to finish run = client.actor("perryay/tech-version-cve-checker").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "stack": [ { "software": "nginx", "version": "1.24.0" }, { "software": "openssl", "version": "3.0.12" }, { "software": "python", "version": "3.11.0" } ] }' | apify call perryay/tech-version-cve-checker --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=perryay/tech-version-cve-checker", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Technology Version CVE Checker 📋", "description": "Batch CVE scanner for your entire technology stack. Check 30+ software packages against the NIST NVD database in a single run. Premium: severe CVE alerts and multi-software scanning.", "version": "1.0", "x-build-id": "hBeQVYVoFIXTSk2cS" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/perryay~tech-version-cve-checker/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-perryay-tech-version-cve-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/perryay~tech-version-cve-checker/runs": { "post": { "operationId": "runs-sync-perryay-tech-version-cve-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/perryay~tech-version-cve-checker/run-sync": { "post": { "operationId": "run-sync-perryay-tech-version-cve-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "stack" ], "properties": { "stack": { "title": "Software Stack", "type": "array", "description": "Array of {software, version} objects representing your technology stack (up to 30 packages per run)" }, "minScore": { "title": "Minimum CVSS Score", "minimum": 0, "maximum": 10, "type": "number", "description": "Minimum CVSS score to include (0.0-10.0)", "default": 0 }, "maxResults": { "title": "Max Results Per Package", "minimum": 1, "maximum": 200, "type": "integer", "description": "Maximum CVE results per software package (1-200)", "default": 50 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```