NVD CVE + CISA KEV Feed

Export CVE vulnerability records from the official NVD API and enrich them with CISA Known Exploited Vulnerabilities (KEV) flags. This Actor is built for vulnerability triage, patch prioritization, security dashboards, RAG pipelines, and compliance reporting.

What it does

• Searches NVD CVE 2.0 by keyword, CVE ID, CPE name, CVSS severity, published date, and last-modified date.
• Adds CISA KEV fields when a CVE is known to be exploited in the wild.
• Saves one normalized dataset item per CVE.
• Omits NVD sourceIdentifier because it can contain maintainer email addresses.
• Uses no browser, no proxy, no login, and no API key.

Input example

{
  "keyword": "apache",
  "cvssSeverity": "HIGH",
  "publishedStartDate": "2026-09-01",
  "publishedEndDate": "2026-10-13",
  "knownExploitedOnly": false,
  "includeKevCatalog": true,
  "includeDescriptions": true,
  "includeReferences": true,
  "includeConfigurations": false,
  "maxResults": 50
}

Output example

{
  "cveId": "CVE-2026-19820",
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-19820",
  "published": "2026-09-01T01:16:33.137",
  "lastModified": "2026-09-11T14:12:00.000",
  "status": "Analyzed",
  "description": "English NVD description...",
  "cvssVersion": "3.1",
  "cvssScore": 7.5,
  "cvssSeverity": "HIGH",
  "weaknesses": ["CWE-..."],
  "affectedProducts": ["vendor/product"],
  "referenceCount": 3,
  "isKnownExploited": false,
  "cisaKnownExploited": null,
  "scrapedAt": "2026-10-13T00:00:00.000Z"
}

Notes and limits

NVD's public API accepts date windows up to 120 days. The Actor validates that limit and defaults to the last 30 days when no dates are supplied. It uses a conservative delay between NVD pages to stay friendly to the public API and respects a maximum of one request per second.

The public data sources are:

• NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0
• CISA KEV catalog: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Suggested pricing

Use pay-per-result pricing at US$0.003 per CVE (US$3.00 per 1,000 results).

Cost estimate:

• NVD returns up to 2,000 CVEs per API page.
• A 1,000-result run normally needs one NVD request plus one optional CISA KEV request.
• No browser and no proxy are used, so platform cost should usually stay well below US$0.25 per 1,000 results.
• At US$3.00 per 1,000 results, there is room for Apify's 20% platform margin and the creator's execution cost.

Compliance posture

This Actor collects public vulnerability records from official U.S. government feeds. It does not collect social media data, does not automate login, does not bypass access controls, and intentionally avoids person/contact fields.

Data sources and notices

This product uses data from the NVD API but is not endorsed or certified by the NVD. The CISA Known Exploited Vulnerabilities (KEV) catalog is a public U.S. government resource. This Actor is not affiliated with NIST or CISA.