# NVD CVE Scraper · Vulnerabilities, CVSS Scores, Vendors & CWEs (`reapx/nvd-cve-scraper`) Actor

Scrape National Vulnerability Database (NVD) CVE records, CVSS v2/v3/v4 severity scores, CWE weakness classifications, vendor products, and exploit references.

- **URL**: https://apify.com/reapx/nvd-cve-scraper.md
- **Developed by:** [Tarek Etman](https://apify.com/reapx) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.30 / 1,000 cve vulnerability record returneds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

![reapX — public sources in, addressable records out](https://reapx.dev/reapx.gif)

## NVD CVE Scraper · Vulnerabilities, CVSS Scores, Vendors & CWEs

Extract comprehensive security vulnerability records, CVSS v2/v3/v4 severity metrics, Common Weakness Enumeration (CWE) classifications, affected software vendors/products, and advisory references from the NIST National Vulnerability Database (NVD) REST API v2.0.

> Maintained by **reapX**. Every row cites the Apify run that produced it — nothing is
> inferred, modelled or filled in, and a field absent from the source is absent from the row.
> The extracted archive for this source is browsable at
> [reapx.dev/data/nvd-cve-scraper/](https://reapx.dev/data/nvd-cve-scraper/) and mirrored as an open dataset on
> [Hugging Face](https://huggingface.co/datasets/reapxdev/nvd-cve-scraper) and
> [Kaggle](https://www.kaggle.com/datasets/reapxdev/nvd-cve-scraper). Questions: reapxdev@proton.me

***

### Overview & Capabilities

The **NVD CVE Scraper** provides structured, real-time access to the complete catalog of Common Vulnerabilities and Exposures (CVE) maintained by the National Institute of Standards and Technology (NIST). Whether performing enterprise vulnerability management, open-source dependency auditing, threat intelligence research, or automated security posture assessment, this scraper allows you to query NVD's REST API v2.0 without complex custom code or rate-limit management.

#### Key Features & Architectural Highlights

- **Flexible Multi-Criteria Filtering:** Filter vulnerability records by specific CVE ID, CWE weakness identifier (e.g., `CWE-79`, `CWE-89`), CVSS v3 base severity (`CRITICAL`, `HIGH`, `MEDIUM`, `LOW`), free-text keyword search, publication/modification date ranges, or CPE virtual match strings.
- **Structured CVSS & Severity Data:** Includes base scores, vector strings, and qualitative risk ratings across CVSS v3.1, v3.0, v4.0, and v2.0 metrics.
- **Software Vendor & Product Extraction:** Automatically parses affected vendor names, product identifiers, and CPE match criteria strings.
- **Reference & Advisory Links:** Captures official vendor advisories, third-party technical writeups, patch links, and NVD detail permalinks.
- **Automatic Backoff & Rate Limit Respect:** Built-in exponential backoff for HTTP 429 rate limiting and 5xx server responses ensures high reliability during large-scale security research runs.
- **Pay-Per-Event Pricing:** Pay only per delivered CVE vulnerability record. Zero charges for rate-limited, empty, or failed requests.

***

### ⬇️ Input

Configure your scraping run using standard JSON input fields. All filter fields are optional; leaving them empty searches the entire NVD database starting from the most recent or matching records.

#### Input Parameters Specification Table

| Field Name | Type | Editor | Prefill / Default | Description |
| :--- | :--- | :--- | :--- | :--- |
| `keywordSearch` | `string` | Text field | `""` | Search phrase or product name (e.g. `Apache`, `WordPress`, `Log4j`). Broader terms match more records, taking longer and increasing cost. Leave empty to return all vulnerabilities without keyword filtering. |
| `cveId` | `string` | Text field | `""` | Direct lookup for a specific Common Vulnerabilities and Exposures identifier (e.g. `CVE-2024-3094`). Returns exactly one vulnerability record quickly at minimal cost. Leave empty to search across all CVE identifiers. |
| `cweId` | `string` | Text field | `""` | Filter by Common Weakness Enumeration ID (e.g. `CWE-79` for XSS or `CWE-89` for SQLi). Narrows search to specific weakness categories. Leave empty to include all CWE weakness types. |
| `cvssV3Severity` | `string` | Dropdown | `""` | Filter by CVSS v3 base severity rating: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`. Restricts results to selected risk severity band. Leave empty to match all severity levels. |
| `pubStartDate` | `string` | Date picker | `""` | Publication date window start (ISO 8601 format, e.g. `2024-01-01T00:00:00.000`). NVD API allows a maximum 120-day span between start and end date. Leave empty for no publication start date limit. |
| `pubEndDate` | `string` | Date picker | `""` | Publication date window end (ISO 8601 format, e.g. `2024-04-01T00:00:00.000`). Narrows publication time window and reduces result size and run cost. Leave empty for no publication end date limit. |
| `lastModStartDate`| `string` | Date picker | `""` | Last modification date window start (ISO 8601 format, e.g. `2024-01-01T00:00:00.000`). Useful for incremental update scraping. |
| `lastModEndDate` | `string` | Date picker | `""` | Last modification date window end (ISO 8601 format, e.g. `2024-04-01T00:00:00.000`). |
| `virtualMatchString` | `string` | Text field | `""` | CPE match string for vendor/product filtering (e.g. `cpe:2.3:a:apache:http_server`). Targets specific software vendor or product versions. Leave empty to retrieve vulnerabilities across all vendors. |
| `maxItems` | `integer` | Number | `200` | Hard cap on total CVE vulnerability records to retrieve and save to the default dataset. Default is 200 items. |
| `apiKey` | `string` | Text field | `""` | Optional NVD API key. Providing a key increases NVD rate limits from 5 requests / 30s to 50 requests / 30s, significantly speeding up large data extraction runs. |

#### Example Input JSON Configurations

##### Example 1: High & Critical Vulnerabilities in 2024

```json
{
  "cvssV3Severity": "CRITICAL",
  "pubStartDate": "2024-01-01T00:00:00.000",
  "pubEndDate": "2024-03-31T23:59:59.000",
  "maxItems": 100
}
```

##### Example 2: CWE-89 (SQL Injection) Search

```json
{
  "cweId": "CWE-89",
  "maxItems": 50
}
```

##### Example 3: Specific Product Vendor Search

```json
{
  "keywordSearch": "WordPress",
  "cvssV3Severity": "HIGH",
  "maxItems": 50
}
```

***

### ⬆️ Output

Every scraped CVE record is pushed directly to the run's default dataset. Each output row represents a single unique vulnerability identified by its standard `id` (e.g. `CVE-2024-3094`).

#### Dataset Fields Specification

| Field Name | Type | Description | Example Value |
| :--- | :--- | :--- | :--- |
| `id` | `string` | Standard Common Vulnerabilities and Exposures identifier (Primary Key). | `"CVE-2024-3094"` |
| `sourceIdentifier` | `string` | Organization or CVE Numbering Authority (CNA) that issued the CVE. | `"cve@mitre.org"` |
| `published` | `string` | ISO 8601 publication date timestamp of the vulnerability entry. | `"2024-03-29T17:15:49.030"` |
| `lastModified` | `string` | ISO 8601 timestamp of last record update in NVD. | `"2024-04-02T11:00:00.000"` |
| `vulnStatus` | `string` | NVD analysis status (`Analyzed`, `Modified`, `Awaiting Analysis`). | `"Analyzed"` |
| `title` | `string` | Human-readable title combining CVE ID and summary for web display. | `"CVE-2024-3094 — Malicious code in xz-utils"` |
| `description` | `string` | Full English text description detailing the vulnerability. | `"Malicious code was discovered in xz-utils versions 5.6.0 and 5.6.1..."` |
| `cvssV3BaseScore` | `number` | Numeric CVSS v3.x base severity score (0.0 to 10.0). | `10.0` |
| `cvssV3Vector` | `string` | Standardized CVSS v3.x vector string. | `"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"` |
| `cvssV3Severity` | `string` | Qualitative risk severity string (`LOW`, `MEDIUM`, `HIGH`, `CRITICAL`). | `"CRITICAL"` |
| `cweId` | `string` | Primary Common Weakness Enumeration ID. | `"CWE-506"` |
| `cweName` | `string` | Descriptive name of the assigned CWE weakness classification. | `"Embedded Malicious Code"` |
| `vendors` | `array[string]` | List of software/hardware vendors affected by this CVE. | `["tukaani"]` |
| `products` | `array[string]` | List of product names affected by this vulnerability. | `["xz"]` |
| `cpeCriteria` | `array[string]` | Array of CPE match criteria strings. | `["cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*"]` |
| `references` | `array[string]` | Array of reference URLs, vendor advisories, and technical writeups. | `["https://nvd.nist.gov/vuln/detail/CVE-2024-3094"]` |
| `cveUrl` | `string` | Direct URL link to official NVD detail page. | `"https://nvd.nist.gov/vuln/detail/CVE-2024-3094"` |

#### Example Output Record JSON

```json
{
  "id": "CVE-2024-3094",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2024-03-29T17:15:49.030",
  "lastModified": "2024-04-02T11:00:00.000",
  "vulnStatus": "Analyzed",
  "title": "CVE-2024-3094 — Malicious code in xz-utils versions 5.6.0 and 5.6.1",
  "description": "Malicious code was discovered in xz-utils versions 5.6.0 and 5.6.1. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in liblzma code.",
  "cvssV3BaseScore": 10.0,
  "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "cvssV3Severity": "CRITICAL",
  "cweId": "CWE-506",
  "cweName": "Embedded Malicious Code",
  "vendors": [
    "tukaani"
  ],
  "products": [
    "xz"
  ],
  "cpeCriteria": [
    "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*",
    "cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:*"
  ],
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2024-3094",
    "https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils",
    "https://access.redhat.com/security/cve/CVE-2024-3094"
  ],
  "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3094"
}
```

***

### How it works

1. **API Handshake & Query Formatting:** The actor formats HTTP GET requests to NVD REST API v2.0 (`https://services.nvd.nist.gov/rest/json/cves/2.0`) incorporating all requested filter parameters, date constraints, and optional API key headers.
2. **Rate Limit Management:** NVD API strictly enforces rate limits (5 requests per 30 seconds for unauthenticated requests, 50 requests per 30 seconds with an API key). The actor dynamically meters outgoing HTTP calls to avoid unnecessary throttling.
3. **Resilient Error Recovery:** In the event of temporary network blips, NVD server maintenance, or HTTP 429 rate limit responses, the actor employs exponential backoff algorithm retries up to 5 times.
4. **Data Normalization & Enrichment:** Raw NVD JSON objects are sanitized into clean, flat dictionaries. Key metrics such as CVSS base scores, vectors, qualitative risk categories, CWE weakness codes, vendor names, and reference links are extracted.
5. **Per-Item Charging & Direct Dataset Push:** Each valid CVE record is charged exactly once under the `cve-returned` pay-per-event pricing model prior to being appended to the run's default dataset. If an item cannot be delivered or NVD returns an empty set, zero event charges occur.

***

### Technical Reference: CVSS Metrics & CWE Categories

#### CVSS v3.1 Severity Rating Bands

The Common Vulnerability Scoring System (CVSS) provides an open framework for communicating the characteristics and severity of software vulnerabilities.

| Qualitative Severity Rating | Base Score Range | Description & Action Guidance |
| :--- | :--- | :--- |
| **None** | 0.0 | Vulnerability has no measurable security impact. |
| **Low** | 0.1 – 3.9 | Minimal impact. Exploitation typically requires local physical access or high privileges. |
| **Medium** | 4.0 – 6.9 | Moderate risk. Requires specific configuration or elevated access to exploit. |
| **High** | 7.0 – 8.9 | High risk. Exploitation can compromise confidentiality, integrity, or system availability. |
| **Critical** | 9.0 – 10.0 | Extreme risk. Typically network accessible, unauthenticated remote code execution or complete system takeover. Immediate patching required. |

#### Top 10 Common Weakness Enumeration (CWE) Identifiers

| CWE ID | Weakness Name | Description |
| :--- | :--- | :--- |
| **CWE-79** | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Web application fails to sanitize untrusted user input before rendering, enabling script execution. |
| **CWE-89** | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unfiltered user input is concatenated into database queries, permitting unauthorized data retrieval or modification. |
| **CWE-20** | Improper Input Validation | Application receives input without properly verifying that it conforms to expected structure or constraints. |
| **CWE-22** | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Software uses external input to construct a pathname without neutralizing directory traversal sequences (`../`). |
| **CWE-78** | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | Software constructs OS commands using externally-supplied input without escaping special characters. |
| **CWE-119** | Improper Restriction of Operations within Bounds of a Memory Buffer | Software performs operations on a memory buffer without verifying boundary limits, causing buffer overflow. |
| **CWE-862** | Missing Authorization | System fails to perform authorization checks when a user attempts to access restricted resources. |
| **CWE-352** | Cross-Site Request Forgery (CSRF) | Web application processes requests initiated by an unauthorized third party without verifying user intent. |
| **CWE-434** | Unrestricted Upload of File with Dangerous Type | Application allows users to upload files without restricting file extensions, enabling remote code execution. |
| **CWE-798** | Use of Hard-coded Credentials | Software contains hardcoded passwords, encryption keys, or API tokens directly within its source code. |

***

### Use Cases & Integration

#### Popular Use Cases

- **Vulnerability Management Pipelines:** Automate daily tracking of newly published CRITICAL or HIGH severity CVEs affecting your tech stack.
- **Supply Chain Security Auditing:** Query vulnerabilities associated with specific software packages, vendors, or CPE criteria to identify exposed components.
- **Threat Intelligence & SOC Dashboards:** Ingest structured CVE data with CVSS scores into SIEMs, threat intelligence platforms, or security data warehouses.
- **Compliance & Benchmark Reporting:** Track vulnerability resolution timelines and publication trends across specific CWE weakness categories (e.g. OWASP Top 10 weaknesses).

#### Code Integration Examples

##### Python (Apify Client SDK)

```python
from apify_client import ApifyClient

## Initialize the ApifyClient with your API token
client = ApifyClient("YOUR_APIFY_TOKEN")

## Prepare actor input parameters
run_input = {
    "cvssV3Severity": "CRITICAL",
    "pubStartDate": "2024-01-01T00:00:00.000",
    "pubEndDate": "2024-03-31T23:59:59.000",
    "maxItems": 100
}

## Run the actor and wait for completion
run = client.actor("reapx/nvd-cve-scraper").call(run_input=run_input)

## Fetch results from the run's default dataset
print(f"Run completed successfully! Dataset ID: {run['defaultDatasetId']}")
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(f"[{item['id']}] {item['title']} - CVSS: {item['cvssV3BaseScore']} ({item['cvssV3Severity']})")
```

##### Node.js / JavaScript (Apify Client SDK)

```javascript
import { ApifyClient } from 'apify-client';

// Initialize client with token
const client = new ApifyClient({ token: 'YOUR_APIFY_TOKEN' });

// Define input filters
const input = {
  keywordSearch: 'Apache',
  cvssV3Severity: 'HIGH',
  maxItems: 50
};

// Call the actor
const run = await client.actor('reapx/nvd-cve-scraper').call(input);

// Fetch items from default dataset
const { items } = await client.dataset(run.defaultDatasetId).listItems();

console.log(`Retrieved ${items.length} vulnerability records:`);
items.forEach(item => {
  console.log(`${item.id}: ${item.title} -> ${item.cveUrl}`);
});
```

##### cURL (Direct HTTP API)

```bash
## Start an actor run via HTTP POST
curl -X POST "https://api.apify.com/v2/acts/reapx~nvd-cve-scraper/runs?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "cweId": "CWE-79",
    "maxItems": 50
  }'
```

##### Go (Native HTTP Integration)

```go
package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
)

func main() {
	apiToken := "YOUR_APIFY_TOKEN"
	url := fmt.Sprintf("https://api.apify.com/v2/acts/reapx~nvd-cve-scraper/runs?token=%s&waitForFinish=120", apiToken)

	payload := map[string]interface{}{
		"cvssV3Severity": "CRITICAL",
		"maxItems":       25,
	}
	body, _ := json.Marshal(payload)

	req, _ := http.NewRequest("POST", url, bytes.NewBuffer(body))
	req.Header.Set("Content-Type", "application/json")

	client := &http.Client{}
	resp, err := client.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	respBody, _ := io.ReadAll(resp.Body)
	fmt.Println("Apify Run Response:", string(respBody))
}
```

***

### ❓ FAQ

##### Q: How does pricing work for this actor?

**A:** This actor uses Apify's Pay-Per-Event (PPE) pricing model. You are charged **$0.002 per delivered CVE record** plus Apify's standard platform start fee ($0.00005). Tiered volume discounts (Bronze through Diamond) automatically reduce the per-record cost down to $0.0008 for high-volume users.

##### Q: Are empty searches or blocked requests charged?

**A:** No. You are billed zero event charges if NVD returns an empty result set, if your query parameters match no vulnerabilities, or if a request fails due to network issues. You are only charged for complete, deliverable CVE records successfully written to your dataset.

##### Q: Do I need an NVD API key to use this scraper?

**A:** No. An API key is completely optional. Without an API key, the actor automatically respects NVD's public rate limit (5 requests per 30 seconds). If you have an NVD API key, providing it in the `apiKey` field increases the allowed rate to 50 requests per 30 seconds, significantly speeding up large data extraction runs.

##### Q: Why is there a 120-day limit on publication date ranges?

**A:** The official NIST NVD REST API v2.0 enforces a strict maximum window of 120 days between `pubStartDate` and `pubEndDate` (and similarly for modification dates). If you need to scrape data over a multi-year period, split your requests into consecutive 90-120 day windows or use severity/keyword filters without date bounds.

##### Q: How frequently is data updated in NVD?

**A:** NIST updates the NVD database continuously throughout the day as new CVE identifiers are assigned by CNAs and analyzed by NIST analysts. Running this scraper on a scheduled cron job (e.g. daily) allows you to maintain an up-to-date vulnerability feed.

##### Q: Can I filter by specific CPE strings?

**A:** Yes. You can pass a Common Platform Enumeration (CPE) match criteria string to the `virtualMatchString` field (e.g., `cpe:2.3:a:apache:http_server`) to retrieve vulnerabilities affecting a specific software product.

***

### 💬 Your feedback

We actively maintain and support the **NVD CVE Scraper**. If you encounter any bugs, need additional fields extracted (such as CVSS v4 detailed metrics or KEV catalog flags), or have feature suggestions, please reach out to us at **reapxdev@proton.me** or open an issue on the Apify Console.

***

<br>

*Disclaimer: Unofficial - not affiliated with NIST or NVD. Collects public data only. reapx. Contact reapxdev@proton.me.*

### 🧪 Example input

A real, runnable configuration — this is an actual input this Actor has run with.

```json
{
  "cvssV3Severity": "CRITICAL",
  "pubStartDate": "2024-01-01T00:00:00.000",
  "pubEndDate": "2024-04-01T00:00:00.000",
  "maxItems": 50
}
```

### 📄 Sample output

One real row from a real run of this Actor, unedited.

```json
{
  "id": "CVE-1999-0095",
  "sourceIdentifier": "cve@mitre.org",
  "published": "1988-10-01T04:00:00.000",
  "lastModified": "2026-06-16T21:47:34.460",
  "vulnStatus": "Modified",
  "title": "CVE-1999-0095 — The debug command in Sendmail is enabled, allowing attackers to execute commands",
  "description": "The debug command in Sendmail is enabled, allowing attackers to execute commands as root.",
  "cvssV3BaseScore": 10.0,
  "cvssV3Vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "cvssV3Severity": "HIGH",
  "cweId": null,
  "cweName": null,
  "vendors": [
    "eric_allman"
  ],
  "products": [
    "sendmail"
  ],
  "cpeCriteria": [
    "cpe:2.3:a:eric_allman:sendmail:5.58:*:*:*:*:*:*:*"
  ],
  "references": [
    "http://seclists.org/fulldisclosure/2019/Jun/16",
    "http://www.openwall.com/lists/oss-security/2019/06/05/4",
    "http://www.openwall.com/lists/oss-security/2019/06/06/1",
    "http://www.osvdb.org/195",
    "http://www.securityfocus.com/bid/1",
    "http://seclists.org/fulldisclosure/2019/Jun/16",
    "http://www.openwall.com/lists/oss-security/2019/06/05/4",
    "http://www.openwall.com/lists/oss-security/2019/06/06/1",
    "http://www.osvdb.org/195",
    "http://www.securityfocus.com/bid/1"
  ],
  "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-1999-0095"
}
```

### ⚠️ Run outcomes and error handling

This Actor reports what happened in the run's **status message**, and it always keeps whatever it collected. These are the outcomes you can get and what each one means.

| Outcome | What it means |
|---|---|
| **Success** | Rows were returned and you were charged `cve-returned` at $0.002 per row. |
| **No matches** | The source returned nothing for your filters. **Nothing is charged.** Widen the date window or drop a filter. |
| **Partial - source refused** | The source rate-limited or refused some requests. The affected items are skipped and named in the log, and **everything already collected is still pushed**. A block never discards a run's work. |

#### What is guaranteed either way

- **Every row is pushed as it is built**, not buffered to the end of the run. Anything that buffers output loses everything to a timeout, a block or a migration; this does not.
- **A field absent from the source is absent from the row.** Nothing is inferred, modelled or filled in to make a row look complete.

# Actor input Schema

## `keywordSearch` (type: `string`):

Filter CVE vulnerabilities matching a specific search term or product name (e.g. <code>Apache</code> or <code>WordPress</code>).<br><br><b>Consequence:</b> Broader keywords match more records, taking longer to retrieve and increasing run cost.<br><br><b>Empty value:</b> Leave empty to return all vulnerabilities without keyword filtering.

## `cveId` (type: `string`):

Lookup a single specific Common Vulnerabilities and Exposures identifier (e.g. <code>CVE-2024-3094</code>).<br><br><b>Consequence:</b> Returns exactly one vulnerability record quickly at minimal cost.<br><br><b>Empty value:</b> Leave empty to search across all CVE identifiers.

## `cweId` (type: `string`):

Filter vulnerabilities by Common Weakness Enumeration identifier (e.g. <code>CWE-79</code> for XSS or <code>CWE-89</code> for SQLi).<br><br><b>Consequence:</b> Narrows search to specific weakness categories.<br><br><b>Empty value:</b> Leave empty to include all CWE weakness types.

## `cvssV3Severity` (type: `string`):

Filter vulnerabilities by CVSS v3 base severity level (<code>LOW</code>, <code>MEDIUM</code>, <code>HIGH</code>, or <code>CRITICAL</code>).<br><br><b>Consequence:</b> Restricts results to selected risk severity band.<br><br><b>Empty value:</b> Leave empty to match all severity levels.

## `pubStartDate` (type: `string`):

Start of the publication date range (e.g. <code>2024-01-01T00:00:00.000</code>).<br><br><b>Consequence:</b> NVD API requires max 120-day span between start and end date.<br><br><b>Empty value:</b> Leave empty for no publication start date limit.

## `pubEndDate` (type: `string`):

End of the publication date range (e.g. <code>2024-04-01T00:00:00.000</code>).<br><br><b>Consequence:</b> Limits total date window and reduces result size and run cost.<br><br><b>Empty value:</b> Leave empty for no publication end date limit.

## `virtualMatchString` (type: `string`):

Filter vulnerabilities by Common Platform Enumeration match string (e.g. <code>cpe:2.3:a:apache:http\_server</code>).<br><br><b>Consequence:</b> Targets specific software vendor or product versions.<br><br><b>Empty value:</b> Leave empty to retrieve vulnerabilities across all vendors.

## `maxItems` (type: `integer`):

Maximum number of CVE vulnerability records to retrieve and save to dataset.<br><br><b>Consequence:</b> Higher values allow retrieving more records but take longer and cost more per record.<br><br><b>Empty value:</b> Defaults to 200 items.<br><br>The higher the number, the longer the run takes and the more you are charged, because you pay per row returned.

## `apiKey` (type: `string`):

Optional NVD API key for higher rate limits (50 requests/30s vs 5 requests/30s without key). See <a href="https://nvd.nist.gov/developers/request-an-api-key">NVD API Key Request</a>.<br><br><b>Consequence:</b> Accelerates scraping speed for large runs.<br><br><b>Empty value:</b> Scrapes without key using standard backoff.

## Actor input object example

```json
{
  "maxItems": 200
}
```

# Actor output Schema

## `results` (type: `string`):

Every record found by this run, one row per item, in the default dataset.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "keywordSearch": "",
    "cveId": "",
    "cweId": "",
    "cvssV3Severity": "",
    "pubStartDate": "",
    "pubEndDate": "",
    "virtualMatchString": "",
    "apiKey": ""
};

// Run the Actor and wait for it to finish
const run = await client.actor("reapx/nvd-cve-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "keywordSearch": "",
    "cveId": "",
    "cweId": "",
    "cvssV3Severity": "",
    "pubStartDate": "",
    "pubEndDate": "",
    "virtualMatchString": "",
    "apiKey": "",
}

# Run the Actor and wait for it to finish
run = client.actor("reapx/nvd-cve-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "keywordSearch": "",
  "cveId": "",
  "cweId": "",
  "cvssV3Severity": "",
  "pubStartDate": "",
  "pubEndDate": "",
  "virtualMatchString": "",
  "apiKey": ""
}' |
apify call reapx/nvd-cve-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,reapx/nvd-cve-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/eGRJ2cI1BgnaWP1bE/builds/EuIyJ07qeclufcvX9/openapi.json