NVD CVE Watchlist Monitor

NVD CVE watchlist monitor. Re-check CVEs you already track on the official NIST NVD 2.0 API. Emit lastModified, CVSS, and vulnStatus changes. Public CVE records only.

This Actor is a scheduled watchlist, not a one-shot dump. You bring identifiers you already have. It returns structured current fields, a change type against your previous snapshot, and a NEXT_SNAPSHOT you own.

Why pay

NIST NVD 2.0 REST API (cveId=) is free. The paid job is bounded, scheduled, charge-after-success monitoring with isolated snapshots, honest nulls, and no fee for failed lookups or suppressed unchanged rows.

• charges per successful watchlist item, with no Actor-start fee
• does not bill source errors or onlyChanges unchanged rows
• does not invent scores, contacts, or matches beyond what the source returned

Not a keyword search of NVD. Not a CVSS scoring opinion. Unauthenticated NVD rate limits apply; cap is 20 IDs.

What you get

{
  "schemaVersion": 1,
  "id": "CVE-2024-21762",
  "status": "ok",
  "cveId": "CVE-2024-21762",
  "vulnStatus": "Analyzed",
  "lastModified": "2024-11-21T09:09:00.000",
  "cvssBaseScore": 9.8,
  "cvssSeverity": "CRITICAL",
  "changeType": "INITIAL",
  "error": null
}

Public example identifiers, not a customer or endorsement. Missing source strings are null — never "N/A".

Quick start

{
  "cves": [
    "CVE-2024-21762"
  ],
  "maxItems": 1
}

Run it, open the dataset, and save NEXT_SNAPSHOT from the default key-value store.

Repeat workflow

1. Keep one watchlist per customer or project.
2. Start a bounded run. Schedule it yourself if you need a cadence.
3. Save the returned NEXT_SNAPSHOT JSON in your private state.
4. On the next run pass it as previousSnapshot and set onlyChanges: true.
5. Route changeType: CHANGED rows for review.

No schedules are enabled by default. Snapshots use the run's default storage, never a shared named store.

Input

Field	Type	Default	What it does
cves	array	—	1–20 CVE-YYYY-NNNN IDs. One NVD request each, 700 ms apart.
maxItems	integer	20	Must cover all unique items; a smaller value is rejected rather than silently dropping IDs.
onlyChanges	boolean	false	Suppress unchanged successful records without charging them. The first observation is still emitted.
previousSnapshot	object	—	Prior NEXT_SNAPSHOT with schemaVersion: 1, kind: "nvd-cve", and a records map.

Pricing

Event	Price	When it happens
Successful watchlist result	$0.004 ($4 / 1,000)	One successful watchlist item written to the dataset
Actor start	none	No custom start fee

You are not charged for: failed requests, parse failures, invalid input, or unchanged records suppressed by onlyChanges. With onlyChanges: false, an unchanged successful refresh is delivered work and is charged. The run stops when eventChargeLimitReached is true.

Worked example. 20 CVEs daily, onlyChanges: true, 1 status/score change/day → $0.004/day ≈ $0.12/month.

Set maxTotalChargeUsd on the run. The Actor launches with a $1.00 minimum max-cost-per-run so a high-volume schedule cannot cap itself at the Console $0.05 default.

Using the API

Keep APIFY_TOKEN on a protected backend.

curl --fail -X POST "https://api.apify.com/v2/acts/technicaldost~nvd-cve-watchlist-monitor/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"cves":["CVE-2024-21762"],"maxItems":1}'

JavaScript

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('technicaldost/nvd-cve-watchlist-monitor').call({
        "cves": [
            "CVE-2024-21762"
        ],
        "maxItems": 1
    });
const { items } = await client.dataset(run.defaultDatasetId).listItems();

n8n. HTTP Request → POST https://api.apify.com/v2/acts/technicaldost~nvd-cve-watchlist-monitor/runs with header Authorization: Bearer {{$credentials.apifyToken}}. Poll the run, then read the default dataset and NEXT_SNAPSHOT.

Limitations

• Public metadata only. No authentication bypass and no non-public personal data.
• Output is only as current as the official source. Lag and outages are reported as errors, not invented rows.
• One request at a time (except shared catalog fetches), 20 seconds per request.
• At most 1,000 snapshot records are retained; SUMMARY.snapshotPruned reports eviction.

Not affiliated with or endorsed by NIST.

Changelog

See CHANGELOG.md. Release 1.0.0 (2026-09-13): caller-owned watchlists, isolated snapshots, $0.004 per successful result, no start fee.