# Security Vulnerability Tracker (CVE) (`scrapemint/cve-vulnerability-tracker`) Actor Track software security vulnerabilities from the US government NVD: search CVEs by keyword, vendor, product and severity, each row with CVSS score, CISA known-exploited flag and EPSS exploit probability. Monitor mode for new CVEs. No API key. - **URL**: https://apify.com/scrapemint/cve-vulnerability-tracker.md - **Developed by:** [Ken M](https://apify.com/scrapemint) (community) - **Categories:** Developer tools, Business - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per usage This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage ## What's an Apify Actor? Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Security Vulnerability Tracker (CVE) Track software security vulnerabilities from the US government's National Vulnerability Database (NVD), enriched with the two signals security teams actually prioritize by: CISA's Known Exploited Vulnerabilities flag (is it being exploited in the wild?) and the EPSS score (how likely is exploitation in the next 30 days?). No API key, no login, no browser. ### What you get One row per CVE: - CVE id, published and last-modified dates, analysis status - description, CVSS base score, severity, vector and version - CWE weakness categories and affected products (CPE identifiers) - **knownExploited** - whether it is on CISA's KEV catalog, with the CISA vulnerability name, the date it was added and the federal patch-by deadline - **epssScore / epssPercentile** - exploit probability from FIRST.org - advisory and patch reference links, and a link to the CVE on nvd.nist.gov ### Ways to search Combine free-text keywords with vendor/product, severity, exploited-only and date filters: ```json { "keywords": ["remote code execution"], "vendor": "fortinet", "product": "fortios", "severity": "CRITICAL", "kevOnly": true, "sinceDays": 90 } ```` - **keywords** - free-text searches across CVE descriptions, one per line - **vendor / product** - limit to one vendor or product using CPE naming (lowercase, underscores: "microsoft", "windows\_10"). Check any known CVE on nvd.nist.gov for the exact tokens. - **severity** - one CVSS v3 severity level (LOW to CRITICAL) - **kevOnly** - only vulnerabilities with confirmed in-the-wild exploitation - **sinceDays** - only CVEs published in the last N days ### Monitor mode Turn on **newOnly**, put the actor on a schedule, and each run emits only CVEs it has not returned before. Point it at the vendors in your stack and get a new-vulnerability alert feed. Runs where nothing new arrived cost nothing. ### Who uses this - **IT and security teams**: a patching-priority feed for your stack - filter by your vendors, sort by EPSS, patch what is actually being exploited first. - **MSPs and consultancies**: track client software portfolios without a paid vulnerability-intelligence subscription. - **Software vendors**: watch CVEs published against your own products and your dependencies. - **Analysts and researchers**: study vulnerability trends by vendor, weakness type or severity with structured data. Pairs with our Website Tech Stack Detector to find what a site runs, then track its vulnerabilities, and with our Lookalike Domain Finder for the phishing side of the house. ### Pricing A small fee per CVE row. Searches that match nothing are free note rows, and the first 2 rows of every run are free. ### Notes - Sources: the NVD CVE API 2.0 and the CISA KEV fields it embeds (both US government public data), plus the EPSS API from FIRST.org. All keyless. - The NVD's keyless rate limit is low, so large pulls are deliberately paced (about one request per 6.5 seconds). A few hundred rows per run is the sweet spot. - Very new CVEs may still be "Awaiting Analysis" and carry no CVSS score yet; EPSS scores appear within a day or two of publication. # Actor input Schema ## `keywords` (type: `array`): Free-text searches across CVE descriptions, one per line ("remote code execution wordpress", "openssl"). Words in one line must all appear. Leave empty to rely on the vendor/product and severity filters alone. ## `vendor` (type: `string`): Limit to one vendor as named in CPE ("microsoft", "cisco", "fortinet"). Lowercase; spaces become underscores automatically. ## `product` (type: `string`): Limit to one product of that vendor as named in CPE ("windows\_10", "ios\_xe", "fortios"). Needs Vendor to be set. Lowercase; spaces become underscores automatically. ## `severity` (type: `string`): Only CVEs whose CVSS v3 base severity is exactly this level. Leave empty for all severities. ## `kevOnly` (type: `boolean`): Only CVEs on CISA's Known Exploited Vulnerabilities catalog - vulnerabilities with confirmed exploitation in the wild. The highest-signal filter for patching priority. ## `sinceDays` (type: `integer`): Only CVEs published in the last N days (in monitor mode: modified in the last N days). 0 = no date limit. ## `includeEpss` (type: `boolean`): Enrich each CVE with its EPSS score - the estimated probability of exploitation in the next 30 days - and percentile, from FIRST.org. ## `includeReferences` (type: `boolean`): Include up to 10 advisory/patch reference URLs per CVE. Turn off for smaller rows. ## `newOnly` (type: `boolean`): Remember CVEs already returned and emit only ones not seen before. Run on a schedule for a clean feed of new vulnerabilities matching your filters - quiet runs cost nothing. ## `maxRows` (type: `integer`): Stop after this many CVE rows in total. ## Actor input object example ```json { "severity": "CRITICAL", "kevOnly": false, "sinceDays": 30, "includeEpss": true, "includeReferences": true, "newOnly": false, "maxRows": 25 } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "severity": "CRITICAL", "sinceDays": 30, "maxRows": 25 }; // Run the Actor and wait for it to finish const run = await client.actor("scrapemint/cve-vulnerability-tracker").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "severity": "CRITICAL", "sinceDays": 30, "maxRows": 25, } # Run the Actor and wait for it to finish run = client.actor("scrapemint/cve-vulnerability-tracker").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "severity": "CRITICAL", "sinceDays": 30, "maxRows": 25 }' | apify call scrapemint/cve-vulnerability-tracker --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=scrapemint/cve-vulnerability-tracker", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Security Vulnerability Tracker (CVE)", "description": "Track software security vulnerabilities from the US government NVD: search CVEs by keyword, vendor, product and severity, each row with CVSS score, CISA known-exploited flag and EPSS exploit probability. Monitor mode for new CVEs. No API key.", "version": "0.1", "x-build-id": "rlHPvBG3gcgS426yR" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/scrapemint~cve-vulnerability-tracker/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-scrapemint-cve-vulnerability-tracker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/scrapemint~cve-vulnerability-tracker/runs": { "post": { "operationId": "runs-sync-scrapemint-cve-vulnerability-tracker", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/scrapemint~cve-vulnerability-tracker/run-sync": { "post": { "operationId": "run-sync-scrapemint-cve-vulnerability-tracker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "keywords": { "title": "Keywords", "type": "array", "description": "Free-text searches across CVE descriptions, one per line (\"remote code execution wordpress\", \"openssl\"). Words in one line must all appear. Leave empty to rely on the vendor/product and severity filters alone.", "items": { "type": "string" } }, "vendor": { "title": "Vendor", "type": "string", "description": "Limit to one vendor as named in CPE (\"microsoft\", \"cisco\", \"fortinet\"). Lowercase; spaces become underscores automatically." }, "product": { "title": "Product", "type": "string", "description": "Limit to one product of that vendor as named in CPE (\"windows_10\", \"ios_xe\", \"fortios\"). Needs Vendor to be set. Lowercase; spaces become underscores automatically." }, "severity": { "title": "Severity", "enum": [ "", "LOW", "MEDIUM", "HIGH", "CRITICAL" ], "type": "string", "description": "Only CVEs whose CVSS v3 base severity is exactly this level. Leave empty for all severities." }, "kevOnly": { "title": "Only known-exploited (CISA KEV)", "type": "boolean", "description": "Only CVEs on CISA's Known Exploited Vulnerabilities catalog - vulnerabilities with confirmed exploitation in the wild. The highest-signal filter for patching priority.", "default": false }, "sinceDays": { "title": "Published within (days)", "minimum": 0, "maximum": 3650, "type": "integer", "description": "Only CVEs published in the last N days (in monitor mode: modified in the last N days). 0 = no date limit.", "default": 30 }, "includeEpss": { "title": "Include EPSS exploit probability", "type": "boolean", "description": "Enrich each CVE with its EPSS score - the estimated probability of exploitation in the next 30 days - and percentile, from FIRST.org.", "default": true }, "includeReferences": { "title": "Include reference links", "type": "boolean", "description": "Include up to 10 advisory/patch reference URLs per CVE. Turn off for smaller rows.", "default": true }, "newOnly": { "title": "Monitor mode: new CVEs only", "type": "boolean", "description": "Remember CVEs already returned and emit only ones not seen before. Run on a schedule for a clean feed of new vulnerabilities matching your filters - quiet runs cost nothing.", "default": false }, "maxRows": { "title": "Max rows", "minimum": 1, "maximum": 20000, "type": "integer", "description": "Stop after this many CVE rows in total.", "default": 100 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```