NVD CVE Scraper · Vulnerabilities, CVSS Scores, Vendors & CWEs

Extract comprehensive security vulnerability records, CVSS v2/v3/v4 severity metrics, Common Weakness Enumeration (CWE) classifications, affected software vendors/products, and advisory references from the NIST National Vulnerability Database (NVD) REST API v2.0.

Maintained by reapX. Every row cites the Apify run that produced it — nothing is inferred, modelled or filled in, and a field absent from the source is absent from the row. The extracted archive for this source is browsable at reapx.dev/data/nvd-cve-scraper/ and mirrored as an open dataset on Hugging Face and Kaggle. Questions: reapxdev@proton.me

---

Overview & Capabilities

The NVD CVE Scraper provides structured, real-time access to the complete catalog of Common Vulnerabilities and Exposures (CVE) maintained by the National Institute of Standards and Technology (NIST). Whether performing enterprise vulnerability management, open-source dependency auditing, threat intelligence research, or automated security posture assessment, this scraper allows you to query NVD's REST API v2.0 without complex custom code or rate-limit management.

Key Features & Architectural Highlights

• Flexible Multi-Criteria Filtering: Filter vulnerability records by specific CVE ID, CWE weakness identifier (e.g., CWE-79, CWE-89), CVSS v3 base severity (CRITICAL, HIGH, MEDIUM, LOW), free-text keyword search, publication/modification date ranges, or CPE virtual match strings.
• Structured CVSS & Severity Data: Includes base scores, vector strings, and qualitative risk ratings across CVSS v3.1, v3.0, v4.0, and v2.0 metrics.
• Software Vendor & Product Extraction: Automatically parses affected vendor names, product identifiers, and CPE match criteria strings.
• Reference & Advisory Links: Captures official vendor advisories, third-party technical writeups, patch links, and NVD detail permalinks.
• Automatic Backoff & Rate Limit Respect: Built-in exponential backoff for HTTP 429 rate limiting and 5xx server responses ensures high reliability during large-scale security research runs.
• Pay-Per-Event Pricing: Pay only per delivered CVE vulnerability record. Zero charges for rate-limited, empty, or failed requests.

---

⬇️ Input

Configure your scraping run using standard JSON input fields. All filter fields are optional; leaving them empty searches the entire NVD database starting from the most recent or matching records.

Input Parameters Specification Table

Field Name	Type	Editor	Prefill / Default	Description
keywordSearch	string	Text field	""	Search phrase or product name (e.g. Apache, WordPress, Log4j). Broader terms match more records, taking longer and increasing cost. Leave empty to return all vulnerabilities without keyword filtering.
cveId	string	Text field	""	Direct lookup for a specific Common Vulnerabilities and Exposures identifier (e.g. CVE-2024-3094). Returns exactly one vulnerability record quickly at minimal cost. Leave empty to search across all CVE identifiers.
cweId	string	Text field	""	Filter by Common Weakness Enumeration ID (e.g. CWE-79 for XSS or CWE-89 for SQLi). Narrows search to specific weakness categories. Leave empty to include all CWE weakness types.
cvssV3Severity	string	Dropdown	""	Filter by CVSS v3 base severity rating: LOW, MEDIUM, HIGH, CRITICAL. Restricts results to selected risk severity band. Leave empty to match all severity levels.
pubStartDate	string	Date picker	""	Publication date window start (ISO 8601 format, e.g. 2024-01-01T00:00:00.000). NVD API allows a maximum 120-day span between start and end date. Leave empty for no publication start date limit.
pubEndDate	string	Date picker	""	Publication date window end (ISO 8601 format, e.g. 2024-04-01T00:00:00.000). Narrows publication time window and reduces result size and run cost. Leave empty for no publication end date limit.
lastModStartDate	string	Date picker	""	Last modification date window start (ISO 8601 format, e.g. 2024-01-01T00:00:00.000). Useful for incremental update scraping.
lastModEndDate	string	Date picker	""	Last modification date window end (ISO 8601 format, e.g. 2024-04-01T00:00:00.000).
virtualMatchString	string	Text field	""	CPE match string for vendor/product filtering (e.g. cpe:2.3:a:apache:http_server). Targets specific software vendor or product versions. Leave empty to retrieve vulnerabilities across all vendors.
maxItems	integer	Number	200	Hard cap on total CVE vulnerability records to retrieve and save to the default dataset. Default is 200 items.
apiKey	string	Text field	""	Optional NVD API key. Providing a key increases NVD rate limits from 5 requests / 30s to 50 requests / 30s, significantly speeding up large data extraction runs.

Example Input JSON Configurations

Example 1: High & Critical Vulnerabilities in 2024

{
  "cvssV3Severity": "CRITICAL",
  "pubStartDate": "2024-01-01T00:00:00.000",
  "pubEndDate": "2024-03-31T23:59:59.000",
  "maxItems": 100
}

Example 2: CWE-89 (SQL Injection) Search

{
  "cweId": "CWE-89",
  "maxItems": 50
}

Example 3: Specific Product Vendor Search

{
  "keywordSearch": "WordPress",
  "cvssV3Severity": "HIGH",
  "maxItems": 50
}

---

⬆️ Output

Every scraped CVE record is pushed directly to the run's default dataset. Each output row represents a single unique vulnerability identified by its standard id (e.g. CVE-2024-3094).

Dataset Fields Specification

Field Name	Type	Description	Example Value
id	string	Standard Common Vulnerabilities and Exposures identifier (Primary Key).	"CVE-2024-3094"
sourceIdentifier	string	Organization or CVE Numbering Authority (CNA) that issued the CVE.	"cve@mitre.org"
published	string	ISO 8601 publication date timestamp of the vulnerability entry.	"2024-03-29T17:15:49.030"
lastModified	string	ISO 8601 timestamp of last record update in NVD.	"2024-04-02T11:00:00.000"
vulnStatus	string	NVD analysis status (Analyzed, Modified, Awaiting Analysis).	"Analyzed"
title	string	Human-readable title combining CVE ID and summary for web display.	"CVE-2024-3094 — Malicious code in xz-utils"
description	string	Full English text description detailing the vulnerability.	"Malicious code was discovered in xz-utils versions 5.6.0 and 5.6.1..."
cvssV3BaseScore	number	Numeric CVSS v3.x base severity score (0.0 to 10.0).	10.0
cvssV3Vector	string	Standardized CVSS v3.x vector string.	"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
cvssV3Severity	string	Qualitative risk severity string (LOW, MEDIUM, HIGH, CRITICAL).	"CRITICAL"
cweId	string	Primary Common Weakness Enumeration ID.	"CWE-506"
cweName	string	Descriptive name of the assigned CWE weakness classification.	"Embedded Malicious Code"
vendors	array[string]	List of software/hardware vendors affected by this CVE.	["tukaani"]
products	array[string]	List of product names affected by this vulnerability.	["xz"]
cpeCriteria	array[string]	Array of CPE match criteria strings.	["cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*"]
references	array[string]	Array of reference URLs, vendor advisories, and technical writeups.	["https://nvd.nist.gov/vuln/detail/CVE-2024-3094"]
cveUrl	string	Direct URL link to official NVD detail page.	"https://nvd.nist.gov/vuln/detail/CVE-2024-3094"

Example Output Record JSON

{
  "id": "CVE-2024-3094",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2024-03-29T17:15:49.030",
  "lastModified": "2024-04-02T11:00:00.000",
  "vulnStatus": "Analyzed",
  "title": "CVE-2024-3094 — Malicious code in xz-utils versions 5.6.0 and 5.6.1",
  "description": "Malicious code was discovered in xz-utils versions 5.6.0 and 5.6.1. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in liblzma code.",
  "cvssV3BaseScore": 10.0,
  "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "cvssV3Severity": "CRITICAL",
  "cweId": "CWE-506",
  "cweName": "Embedded Malicious Code",
  "vendors": [
    "tukaani"
  ],
  "products": [
    "xz"
  ],
  "cpeCriteria": [
    "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*",
    "cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:*"
  ],
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2024-3094",
    "https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils",
    "https://access.redhat.com/security/cve/CVE-2024-3094"
  ],
  "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3094"
}

---

How it works

1. API Handshake & Query Formatting: The actor formats HTTP GET requests to NVD REST API v2.0 (https://services.nvd.nist.gov/rest/json/cves/2.0) incorporating all requested filter parameters, date constraints, and optional API key headers.
2. Rate Limit Management: NVD API strictly enforces rate limits (5 requests per 30 seconds for unauthenticated requests, 50 requests per 30 seconds with an API key). The actor dynamically meters outgoing HTTP calls to avoid unnecessary throttling.
3. Resilient Error Recovery: In the event of temporary network blips, NVD server maintenance, or HTTP 429 rate limit responses, the actor employs exponential backoff algorithm retries up to 5 times.
4. Data Normalization & Enrichment: Raw NVD JSON objects are sanitized into clean, flat dictionaries. Key metrics such as CVSS base scores, vectors, qualitative risk categories, CWE weakness codes, vendor names, and reference links are extracted.
5. Per-Item Charging & Direct Dataset Push: Each valid CVE record is charged exactly once under the cve-returned pay-per-event pricing model prior to being appended to the run's default dataset. If an item cannot be delivered or NVD returns an empty set, zero event charges occur.

---

Technical Reference: CVSS Metrics & CWE Categories

CVSS v3.1 Severity Rating Bands

The Common Vulnerability Scoring System (CVSS) provides an open framework for communicating the characteristics and severity of software vulnerabilities.

Qualitative Severity Rating	Base Score Range	Description & Action Guidance
None	0.0	Vulnerability has no measurable security impact.
Low	0.1 – 3.9	Minimal impact. Exploitation typically requires local physical access or high privileges.
Medium	4.0 – 6.9	Moderate risk. Requires specific configuration or elevated access to exploit.
High	7.0 – 8.9	High risk. Exploitation can compromise confidentiality, integrity, or system availability.
Critical	9.0 – 10.0	Extreme risk. Typically network accessible, unauthenticated remote code execution or complete system takeover. Immediate patching required.

Top 10 Common Weakness Enumeration (CWE) Identifiers

CWE ID	Weakness Name	Description
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Web application fails to sanitize untrusted user input before rendering, enabling script execution.
CWE-89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	Unfiltered user input is concatenated into database queries, permitting unauthorized data retrieval or modification.
CWE-20	Improper Input Validation	Application receives input without properly verifying that it conforms to expected structure or constraints.
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	Software uses external input to construct a pathname without neutralizing directory traversal sequences (../).
CWE-78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	Software constructs OS commands using externally-supplied input without escaping special characters.
CWE-119	Improper Restriction of Operations within Bounds of a Memory Buffer	Software performs operations on a memory buffer without verifying boundary limits, causing buffer overflow.
CWE-862	Missing Authorization	System fails to perform authorization checks when a user attempts to access restricted resources.
CWE-352	Cross-Site Request Forgery (CSRF)	Web application processes requests initiated by an unauthorized third party without verifying user intent.
CWE-434	Unrestricted Upload of File with Dangerous Type	Application allows users to upload files without restricting file extensions, enabling remote code execution.
CWE-798	Use of Hard-coded Credentials	Software contains hardcoded passwords, encryption keys, or API tokens directly within its source code.

---

Use Cases & Integration

Popular Use Cases

• Vulnerability Management Pipelines: Automate daily tracking of newly published CRITICAL or HIGH severity CVEs affecting your tech stack.
• Supply Chain Security Auditing: Query vulnerabilities associated with specific software packages, vendors, or CPE criteria to identify exposed components.
• Threat Intelligence & SOC Dashboards: Ingest structured CVE data with CVSS scores into SIEMs, threat intelligence platforms, or security data warehouses.
• Compliance & Benchmark Reporting: Track vulnerability resolution timelines and publication trends across specific CWE weakness categories (e.g. OWASP Top 10 weaknesses).

Code Integration Examples

Python (Apify Client SDK)

from apify_client import ApifyClient

# Initialize the ApifyClient with your API token
client = ApifyClient("YOUR_APIFY_TOKEN")

# Prepare actor input parameters
run_input = {
    "cvssV3Severity": "CRITICAL",
    "pubStartDate": "2024-01-01T00:00:00.000",
    "pubEndDate": "2024-03-31T23:59:59.000",
    "maxItems": 100
}

# Run the actor and wait for completion
run = client.actor("reapx/nvd-cve-scraper").call(run_input=run_input)

# Fetch results from the run's default dataset
print(f"Run completed successfully! Dataset ID: {run['defaultDatasetId']}")
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(f"[{item['id']}] {item['title']} - CVSS: {item['cvssV3BaseScore']} ({item['cvssV3Severity']})")

Node.js / JavaScript (Apify Client SDK)

import { ApifyClient } from 'apify-client';

// Initialize client with token
const client = new ApifyClient({ token: 'YOUR_APIFY_TOKEN' });

// Define input filters
const input = {
  keywordSearch: 'Apache',
  cvssV3Severity: 'HIGH',
  maxItems: 50
};

// Call the actor
const run = await client.actor('reapx/nvd-cve-scraper').call(input);

// Fetch items from default dataset
const { items } = await client.dataset(run.defaultDatasetId).listItems();

console.log(`Retrieved ${items.length} vulnerability records:`);
items.forEach(item => {
  console.log(`${item.id}: ${item.title} -> ${item.cveUrl}`);
});

cURL (Direct HTTP API)

# Start an actor run via HTTP POST
curl -X POST "https://api.apify.com/v2/acts/reapx~nvd-cve-scraper/runs?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "cweId": "CWE-79",
    "maxItems": 50
  }'

Go (Native HTTP Integration)

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
)

func main() {
	apiToken := "YOUR_APIFY_TOKEN"
	url := fmt.Sprintf("https://api.apify.com/v2/acts/reapx~nvd-cve-scraper/runs?token=%s&waitForFinish=120", apiToken)

	payload := map[string]interface{}{
		"cvssV3Severity": "CRITICAL",
		"maxItems":       25,
	}
	body, _ := json.Marshal(payload)

	req, _ := http.NewRequest("POST", url, bytes.NewBuffer(body))
	req.Header.Set("Content-Type", "application/json")

	client := &http.Client{}
	resp, err := client.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	respBody, _ := io.ReadAll(resp.Body)
	fmt.Println("Apify Run Response:", string(respBody))
}

---

❓ FAQ

Q: How does pricing work for this actor?

A: This actor uses Apify's Pay-Per-Event (PPE) pricing model. You are charged $0.002 per delivered CVE record plus Apify's standard platform start fee ($0.00005). Tiered volume discounts (Bronze through Diamond) automatically reduce the per-record cost down to $0.0008 for high-volume users.

Q: Are empty searches or blocked requests charged?

A: No. You are billed zero event charges if NVD returns an empty result set, if your query parameters match no vulnerabilities, or if a request fails due to network issues. You are only charged for complete, deliverable CVE records successfully written to your dataset.

Q: Do I need an NVD API key to use this scraper?

A: No. An API key is completely optional. Without an API key, the actor automatically respects NVD's public rate limit (5 requests per 30 seconds). If you have an NVD API key, providing it in the apiKey field increases the allowed rate to 50 requests per 30 seconds, significantly speeding up large data extraction runs.

Q: Why is there a 120-day limit on publication date ranges?

A: The official NIST NVD REST API v2.0 enforces a strict maximum window of 120 days between pubStartDate and pubEndDate (and similarly for modification dates). If you need to scrape data over a multi-year period, split your requests into consecutive 90-120 day windows or use severity/keyword filters without date bounds.

Q: How frequently is data updated in NVD?

A: NIST updates the NVD database continuously throughout the day as new CVE identifiers are assigned by CNAs and analyzed by NIST analysts. Running this scraper on a scheduled cron job (e.g. daily) allows you to maintain an up-to-date vulnerability feed.

Q: Can I filter by specific CPE strings?

A: Yes. You can pass a Common Platform Enumeration (CPE) match criteria string to the virtualMatchString field (e.g., cpe:2.3:a:apache:http_server) to retrieve vulnerabilities affecting a specific software product.

---

💬 Your feedback

We actively maintain and support the NVD CVE Scraper. If you encounter any bugs, need additional fields extracted (such as CVSS v4 detailed metrics or KEV catalog flags), or have feature suggestions, please reach out to us at reapxdev@proton.me or open an issue on the Apify Console.

---

Disclaimer: Unofficial - not affiliated with NIST or NVD. Collects public data only. reapx. Contact reapxdev@proton.me.

🧪 Example input

A real, runnable configuration — this is an actual input this Actor has run with.

{
  "cvssV3Severity": "CRITICAL",
  "pubStartDate": "2024-01-01T00:00:00.000",
  "pubEndDate": "2024-04-01T00:00:00.000",
  "maxItems": 50
}

📄 Sample output

One real row from a real run of this Actor, unedited.

{
  "id": "CVE-1999-0095",
  "sourceIdentifier": "cve@mitre.org",
  "published": "1988-10-01T04:00:00.000",
  "lastModified": "2026-06-16T21:47:34.460",
  "vulnStatus": "Modified",
  "title": "CVE-1999-0095 — The debug command in Sendmail is enabled, allowing attackers to execute commands",
  "description": "The debug command in Sendmail is enabled, allowing attackers to execute commands as root.",
  "cvssV3BaseScore": 10.0,
  "cvssV3Vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "cvssV3Severity": "HIGH",
  "cweId": null,
  "cweName": null,
  "vendors": [
    "eric_allman"
  ],
  "products": [
    "sendmail"
  ],
  "cpeCriteria": [
    "cpe:2.3:a:eric_allman:sendmail:5.58:*:*:*:*:*:*:*"
  ],
  "references": [
    "http://seclists.org/fulldisclosure/2019/Jun/16",
    "http://www.openwall.com/lists/oss-security/2019/06/05/4",
    "http://www.openwall.com/lists/oss-security/2019/06/06/1",
    "http://www.osvdb.org/195",
    "http://www.securityfocus.com/bid/1",
    "http://seclists.org/fulldisclosure/2019/Jun/16",
    "http://www.openwall.com/lists/oss-security/2019/06/05/4",
    "http://www.openwall.com/lists/oss-security/2019/06/06/1",
    "http://www.osvdb.org/195",
    "http://www.securityfocus.com/bid/1"
  ],
  "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-1999-0095"
}

⚠️ Run outcomes and error handling

This Actor reports what happened in the run's status message, and it always keeps whatever it collected. These are the outcomes you can get and what each one means.

Outcome	What it means
Success	Rows were returned and you were charged cve-returned at $0.002 per row.
No matches	The source returned nothing for your filters. Nothing is charged. Widen the date window or drop a filter.
Partial - source refused	The source rate-limited or refused some requests. The affected items are skipped and named in the log, and everything already collected is still pushed. A block never discards a run's work.

What is guaranteed either way

• Every row is pushed as it is built, not buffered to the end of the run. Anything that buffers output loses everything to a timeout, a block or a migration; this does not.
• A field absent from the source is absent from the row. Nothing is inferred, modelled or filled in to make a row look complete.