CVE Risk Brief (NVD + EPSS + CISA KEV) avatar

CVE Risk Brief (NVD + EPSS + CISA KEV)

Pricing

from $4.00 / 1,000 results

Go to Apify Store
CVE Risk Brief (NVD + EPSS + CISA KEV)

CVE Risk Brief (NVD + EPSS + CISA KEV)

Give CVE ids, get one clean row each: CVSS score, EPSS exploit probability, CISA Known-Exploited flag, affected vendor/product, and a ready-to-use priority label (act_now / high / medium / low). Official sources, no API key.

Pricing

from $4.00 / 1,000 results

Rating

0.0

(0)

Developer

Sasha Secrier

Sasha Secrier

Maintained by Community

Actor stats

0

Bookmarked

2

Total users

1

Monthly active users

2 days ago

Last modified

Categories

Share

Give it CVE ids, get one clean row per CVE that answers "how urgent is this?": CVSS score, EPSS exploit probability, whether CISA lists it as actively exploited, the affected vendor/product, and a ready-made priority label. No API key needed.

Output

{
"cveId": "CVE-2021-44228",
"found": true,
"priority": "act_now",
"cvssScore": 10.0,
"cvssSeverity": "CRITICAL",
"epss": 0.99999,
"knownExploited": true,
"kevDueDate": "2021-12-24",
"kevRansomwareUse": "Known",
"vendor": "Apache",
"product": "Log4j2",
"summary": "CVE-2021-44228 is in the CISA Known Exploited Vulnerabilities catalog (used in ransomware campaigns); exploitation probability in the next 30 days 100.0% (EPSS); priority: act_now"
}

Other fields: description, published, lastModified, cvssVersion, cvssVector, cwes, epssPercentile, kevDateAdded, kevRequiredAction.

Priority rule (deterministic, documented)

LabelWhen
act_nowListed in the CISA Known Exploited Vulnerabilities catalog
highEPSS >= 10% or CVSS >= 9.0
mediumEPSS >= 1% or CVSS >= 7.0
lowAnything else with data
unknownNo CVSS and no EPSS data (new or unknown CVE)

The label is a triage aid, not a replacement for your own risk assessment.

Input

FieldMeaning
cveIdsList of ids such as CVE-2021-44228 (max 50 per run).
nvdApiKeyOptional free key from nvd.nist.gov; speeds up large lists.

Without a key the Actor waits about 6.5 s between CVEs (NVD's public rate limit), so 50 CVEs take around 5 minutes.

Good for

  • AI agents and security automations that must decide which vulnerability to patch first.
  • Turning a scanner's CVE list into a prioritised report.
  • Scheduled checks of a watchlist.

Data sources

NVD (NIST), FIRST EPSS, and the CISA KEV catalog. This Actor is independent and not affiliated with or endorsed by these organisations. Data is returned as published; verify before acting on critical systems.

Pricing

Pay per result (one row = one CVE). See the pricing box on this page.