CVE Monitor: NVD + CISA Known Exploited Vulnerabilities (KEV)

Get new vulnerabilities for the software you run: CVEs from the NVD for your keywords (openssl, nginx, wordpress, fortinet …) with CVSS score, severity, CWE and affected products, and a clear flag when CISA lists the CVE as actively exploited (KEV, with CISA's due date and required action). A second mode watches the KEV catalog itself and returns every new "exploited in the wild" entry. Scheduled runs deliver only what is new since the last run.

Typical uses: a daily security digest for your stack · alerting on actively exploited CVEs in products you use · feeding new CVEs into Slack/Jira via an Apify integration · MSPs watching client technologies.

Two modes

1 · cve_keywords: NVD search per keyword (published or last-modified within the window, max 120 days), filters minSeverity and onlyKev. Every CVE is checked against the current KEV catalog. 2 · kev_new: new entries in CISA's KEV catalog (optionally filtered by vendor/product keywords). The first run only remembers the catalog (baseline) unless you choose deliver / kevSinceDate.

Output

CVE rows: cveId · keyword · severity · cvssScore · cvssVersion · cvssVector · cwe[] · affectedProducts[] (vendor:product from CPE) · inKev · kevDateAdded · kevDueDate · kevRansomwareUse · kevRequiredAction · published · lastModified · status · description · references[] · nvdUrl KEV rows: cveId · vendor · product · vulnerabilityName · dateAdded · dueDate · knownRansomwareCampaignUse · shortDescription · requiredAction · cwes · nvdUrl

Example (real runs, 13.10.2026)

• Keywords openssl, nginx, wordpress, last 30 days → 1,128 CVEs (wordpress 1,058, nginx 48, openssl 22; 75 critical). A second run right after: 0 new.
• KEV mode, added since 2026-10-01 → 10 entries, e.g.

{ "cveId": "CVE-2026-104935", "vendor": "Ivanti", "product": "Connect Secure", "dateAdded": "2026-10-13", "dueDate": "2026-10-16", "knownRansomwareCampaignUse": "Unknown" }

Cost control

Broad keywords are big (WordPress plugins alone produce ~1,000 CVEs a month). Use minSeverity (e.g. HIGH), onlyKev, or maxCvesPerKeyword (default 200). CVEs above the cap are not lost, they come in the next run.

Pricing

Pay per event: $0.003 per CVE row, $0.003 per KEV entry on the free plan, −10/−20/−30 % on higher Apify plans. Already-delivered and filtered CVEs are never charged.

Sources, license, limits

• NVD (NIST): This product uses data from the NVD API but is not endorsed or certified by the NVD. Without an API key the NVD allows 5 requests per 30 seconds; the Actor waits accordingly. Add your free NVD key (nvdApiKey, stored as a secret) for faster runs.
• CISA KEV catalog: "distributed under the Creative Commons 0 1.0 License". Not endorsed by CISA or DHS.
• Keyword search is NVD's keyword search over CVE descriptions, not exact product matching. Check affectedProducts. New CVEs often have no CVSS score for a few days (severity: null); with minSeverity they are skipped until scored (use dateField: modified to catch them later).