NVD CVE Vulnerability Scraper (CVSS, CWE, CPE)

Here is one real result, with every field the actor returns:

{
  "cveId": "CVE-1999-1237",
  "published": "1999-06-06T04:00:00.000",
  "lastModified": "2026-06-16T21:50:00.657",
  "vulnStatus": "Modified",
  "description": "Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows remote attackers to execute arbitrary commands via (1) a long username, (2) a long password, and (3) other unspecified methods.",
  "cvssV3Score": 10,
  "cvssSeverity": "HIGH",
  "cvssVersion": "2.0",
  "cvssVector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "cwe": ["CWE-120"],
  "sourceIdentifier": "cve@mitre.org",
  "references": [
    "http://www.securityfocus.com/archive/1/14384",
    "https://exchange.xforce.ibmcloud.com/vulnerabilities/2272"
  ],
  "affectedProducts": ["cpe:2.3:a:apache:http_server:-:*:*:*:*:*:*:*"],
  "url": "https://nvd.nist.gov/vuln/detail/CVE-1999-1237",
  "source": "National Vulnerability Database",
  "observedAt": "2026-08-10T14:31:59.367Z"
}

The most complete NVD CVE scraper available. It returns every field the National Vulnerability Database exposes for each vulnerability, including the CVSS score, severity, version and vector, the CWE weakness list, the affected-product CPE list and every reference URL, and gives you keyword, date-range and exact-ID lookup to target exactly the CVEs you need.

📥 Input · 📤 Output · 💰 Pricing · ▶️ Examples

Table of contents

• What it does
• Quickstart
• Input reference
• Output reference
• Example output record
• Run via API and CLI
• Fetch results
• Billing and limits
• FAQ and troubleshooting

What it does

The actor queries the NIST National Vulnerability Database (NVD), applies the filters you pass as input, paginates through the matching CVEs, and writes one normalized record per vulnerability to the run's dataset. You can search by keyword against the vulnerability description, restrict to a published date range, or fetch one exact vulnerability by its CVE ID.

Each record is flattened for analysis: the CVE identifier and status, the full description, the CVSS score, severity, version and vector, the CWE weakness list, the affected-product CPE list, and every reference URL. Missing source values are returned as null or empty arrays, never invented.

Quickstart

Open the actor, paste this into the input, and press Run. It returns up to 10 CVEs matching "apache".

{
  "keyword": "apache",
  "maxCVEs": 10
}

To fetch one exact vulnerability, set cveId (for example CVE-2021-44228). Every input field is optional; with an empty input the actor searches for apache.

Input reference

Field	Type	Required	Default	Description
keyword	string	no	apache (prefill)	Search CVEs by keyword against the description, for example wordpress, remote code execution, openssl.
maxCVEs	integer	no	10	Maximum number of CVEs to collect (1 to 1000000).
cveId	string	no	(empty)	Fetch a single vulnerability by its exact CVE ID, for example CVE-2021-44228.
pubStartDate	string	no	(empty)	Only CVEs published on or after this ISO-8601 date-time, for example 2024-01-01T00:00:00.000. Requires pubEndDate; the range must not exceed 120 days.
pubEndDate	string	no	(empty)	Only CVEs published on or before this ISO-8601 date-time, for example 2024-03-01T00:00:00.000. Requires pubStartDate.

Filters combine with logical AND. When cveId is set, the other filters are ignored.

Output reference

One dataset item per CVE. Types: string, number, array, or null when the source value is absent.

Field	Type	Description
cveId	string	CVE identifier (unique per vulnerability), for example CVE-1999-1237.
published	string	ISO-8601 date-time the CVE was published.
lastModified	string	ISO-8601 date-time the CVE was last modified.
vulnStatus	string	NVD status, for example Analyzed, Modified, Awaiting Analysis.
description	string	Full vulnerability description.
cvssV3Score	number	Base CVSS score (0 to 10) from the best available metric, or null.
cvssSeverity	string	Severity label: LOW, MEDIUM, HIGH, CRITICAL, or null.
cvssVersion	string	CVSS version the score/vector come from, for example 3.1, 3.0, 2.0.
cvssVector	string	CVSS vector string, or null.
cwe	string[]	CWE weakness identifiers, for example CWE-120. Empty array when none.
sourceIdentifier	string	Source that assigned or last updated the CVE, for example cve@mitre.org.
references	string[]	Reference URLs (advisories, patches, discussion).
affectedProducts	string[]	Affected-product CPE 2.3 match strings.
url	string	Public NVD detail page for the CVE.
source	string	Always National Vulnerability Database.
observedAt	string	ISO 8601 timestamp of when the record was collected.
error	string	Present only on a failed run, when a single item with a populated error field is written instead.

Example output record

Real record from a live run (input {"keyword": "apache", "maxCVEs": 10}). This one carries a CVSS 3.1 score and vector:

{
  "cveId": "CVE-1999-0236",
  "published": "1997-01-01T05:00:00.000",
  "lastModified": "2026-06-16T21:47:58.393",
  "vulnStatus": "Modified",
  "description": "ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs.",
  "cvssV3Score": 7.5,
  "cvssSeverity": "HIGH",
  "cvssVersion": "3.1",
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "cwe": [],
  "sourceIdentifier": "cve@mitre.org",
  "references": ["https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0236"],
  "affectedProducts": [
    "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
    "cpe:2.3:a:illinois:ncsa_httpd:-:*:*:*:*:*:*:*"
  ],
  "url": "https://nvd.nist.gov/vuln/detail/CVE-1999-0236",
  "source": "National Vulnerability Database",
  "observedAt": "2026-08-10T14:31:59.367Z"
}

Run via API and CLI

Start a run and wait for it to finish, then read the dataset. Replace <TOKEN> with your Apify API token.

Run synchronously and get dataset items in one call:

curl -X POST "https://api.apify.com/v2/acts/scrapers_lat~nvd-cve-scraper/run-sync-get-dataset-items?token=<TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"keyword":"openssl","maxCVEs":25}'

Start a run asynchronously:

curl -X POST "https://api.apify.com/v2/acts/scrapers_lat~nvd-cve-scraper/runs?token=<TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"pubStartDate":"2024-01-01T00:00:00.000","pubEndDate":"2024-03-01T00:00:00.000","maxCVEs":100}'

Apify CLI:

apify call scrapers_lat/nvd-cve-scraper \
  --input '{"cveId":"CVE-2021-44228"}'

Fetch results

Every run writes to a dataset. Fetch items as JSON, CSV, or Excel by changing format:

# JSON
curl "https://api.apify.com/v2/datasets/<DATASET_ID>/items?token=<TOKEN>&clean=true&format=json"

# CSV
curl "https://api.apify.com/v2/datasets/<DATASET_ID>/items?token=<TOKEN>&clean=true&format=csv"

# Paginate large datasets
curl "https://api.apify.com/v2/datasets/<DATASET_ID>/items?token=<TOKEN>&offset=1000&limit=1000"

<DATASET_ID> is returned as defaultDatasetId in the run object. Use offset and limit to page through large result sets. clean=true drops empty and internal fields.

Billing and limits

• Pay per result. You are charged per CVE record returned (result event). See the pricing tab for the current per-result price.
• No charge on failure. If a run errors, the actor writes a single item with a populated error field and does not charge for it. Empty runs cost nothing.
• Spend cap respected. Set maxTotalChargeUsd on the run; once reached, the actor stops emitting and charging further billable results.
• Free Apify plans are capped at 10 records per run. Upgrade for higher maxCVEs.
• Source date-range limit. When using pubStartDate and pubEndDate, the NVD API requires both and limits the window to 120 days per query. For longer histories, split the work into consecutive windows.

FAQ and troubleshooting

A run returned 0 records. Why? The keyword or date range matched no CVEs. Try a broader keyword or a different window. Zero-result runs are not charged.

How do I fetch one exact vulnerability? Set cveId to the exact identifier, for example CVE-2021-44228. The other filters are then ignored.

Which CVSS version does cvssV3Score use? The actor reports the best available metric and records which version it came from in cvssVersion (for example 3.1, 3.0 or 2.0). The matching vector is in cvssVector.

Why is cwe an empty array? The NVD has not assigned a CWE weakness to that CVE. Missing values are returned as empty arrays or null, never invented.

Can I pull a whole date range? Yes. Set pubStartDate and pubEndDate (both required, max 120 days apart). For longer histories, run consecutive windows.

Is this an official NIST tool? No. This actor is independent and has no affiliation with NIST or the NVD. It reads only data that is publicly available through the National Vulnerability Database.

Related scrapers

• GitHub Repositories Scraper: Search and extract GitHub repositories with metadata.
• CPSC Recalls Scraper: US consumer product safety recalls.
• openFDA Food Recalls Scraper: US FDA food recall and enforcement records.
• Hacker News Scraper: Hacker News stories and discussion.
• Docker Hub Images Scraper: Docker Hub image metadata and pull counts.

More scrapers at scrapers.lat

Built and maintained by scrapers.lat, where we publish scrapers for US and Latin American public platforms: company registries, government data, finance, e-commerce and more. Browse the catalog or request a custom scraper at scrapers.lat.

---

Independent tool, not affiliated with NIST or the National Vulnerability Database. Accesses only publicly available NVD data.