# CVE Monitor · NVD + CISA Known Exploited (KEV) (`thequietstack/cve-kev-monitor`) Actor

New vulnerabilities for your tech stack: CVEs from the NVD for your keywords (openssl, nginx, wordpress …) with CVSS score, CWE and affected products, flagged when CISA lists them as actively exploited (KEV, with due date). Plus a feed of new KEV entries. Only new since the last run.

- **URL**: https://apify.com/thequietstack/cve-kev-monitor.md
- **Developed by:** [TheQuietStack](https://apify.com/thequietstack) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.10 / 1,000 cves

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CVE Monitor: NVD + CISA Known Exploited Vulnerabilities (KEV)

Get **new vulnerabilities for the software you run**: CVEs from the **NVD** for your keywords (openssl, nginx, wordpress, fortinet …) with
**CVSS score, severity, CWE and affected products**, and a clear flag when **CISA lists the CVE as actively exploited** (KEV, with CISA's due date
and required action). A second mode watches the **KEV catalog itself** and returns every new "exploited in the wild" entry.
Scheduled runs deliver **only what is new** since the last run.

**Typical uses:** a daily security digest for your stack · alerting on actively exploited CVEs in products you use · feeding new CVEs into
Slack/Jira via an Apify integration · MSPs watching client technologies.

### Two modes

**1 · `cve_keywords`:** NVD search per keyword (published or last-modified within the window, max 120 days), filters `minSeverity` and `onlyKev`.
Every CVE is checked against the current KEV catalog.
**2 · `kev_new`:** new entries in CISA's KEV catalog (optionally filtered by vendor/product keywords). The first run only remembers the catalog
(baseline) unless you choose `deliver` / `kevSinceDate`.

### Output

CVE rows: `cveId` · `keyword` · `severity` · `cvssScore` · `cvssVersion` · `cvssVector` · `cwe[]` · `affectedProducts[]` (vendor:product from CPE) ·
`inKev` · `kevDateAdded` · `kevDueDate` · `kevRansomwareUse` · `kevRequiredAction` · `published` · `lastModified` · `status` · `description` · `references[]` · `nvdUrl`
KEV rows: `cveId` · `vendor` · `product` · `vulnerabilityName` · `dateAdded` · `dueDate` · `knownRansomwareCampaignUse` · `shortDescription` · `requiredAction` · `cwes` · `nvdUrl`

### Example (real runs, 13.10.2026)

- Keywords `openssl, nginx, wordpress`, last 30 days → **1,128 CVEs** (wordpress 1,058, nginx 48, openssl 22; 75 critical). A second run right after: **0 new**.
- KEV mode, added since 2026-10-01 → **10 entries**, e.g.

```json
{ "cveId": "CVE-2026-104935", "vendor": "Ivanti", "product": "Connect Secure", "dateAdded": "2026-10-13", "dueDate": "2026-10-16", "knownRansomwareCampaignUse": "Unknown" }
```

### Cost control

Broad keywords are big (WordPress plugins alone produce ~1,000 CVEs a month). Use `minSeverity` (e.g. HIGH), `onlyKev`, or `maxCvesPerKeyword`
(default 200). CVEs above the cap are **not lost**, they come in the next run.

### Pricing

Pay per event: **$0.003 per CVE row**, **$0.003 per KEV entry** on the free plan, −10/−20/−30 % on higher Apify plans. Already-delivered and
filtered CVEs are never charged.

### Sources, license, limits

- **NVD** (NIST): *This product uses data from the NVD API but is not endorsed or certified by the NVD.* Without an API key the NVD allows
  5 requests per 30 seconds; the Actor waits accordingly. Add your free NVD key (`nvdApiKey`, stored as a secret) for faster runs.
- **CISA KEV catalog:** "distributed under the Creative Commons 0 1.0 License". Not endorsed by CISA or DHS.
- Keyword search is NVD's keyword search over CVE descriptions, not exact product matching. Check `affectedProducts`. New CVEs often have no
  CVSS score for a few days (`severity: null`); with `minSeverity` they are skipped until scored (use `dateField: modified` to catch them later).

# Actor input Schema

## `mode` (type: `string`):

Keyword mode searches the NVD; KEV mode watches the CISA catalog of vulnerabilities exploited in the wild.

## `keywords` (type: `array`):

One per line, e.g. openssl, nginx, wordpress, fortinet. In KEV mode they filter vendor/product (empty = all).

## `lookbackDays` (type: `integer`):

CVEs published (or modified, see below) in the last N days. NVD allows at most 120 days per query.

## `dateField` (type: `string`):

Which NVD date the look-back window applies to.

## `minSeverity` (type: `string`):

CVEs below this CVSS severity are skipped (not charged).

## `maxCvesPerKeyword` (type: `integer`):

Cost guard for broad keywords (e.g. wordpress has ~1,000 CVEs a month). CVEs above the limit are not lost: they come in the next run.

## `onlyKev` (type: `boolean`):

Keyword mode: return only CVEs that are in CISA's KEV catalog.

## `onlyNew` (type: `boolean`):

Remembers CVE id + last-modified per keyword; a CVE comes again only when NVD updates it.

## `firstRunMode` (type: `string`):

baseline = the first run only remembers the current catalog and alerts start with the next run; deliver = return current entries (use 'KEV since date' to limit).

## `kevSinceDate` (type: `string`):

YYYY-MM-DD. Only KEV entries added on or after this date.

## `nvdApiKey` (type: `string`):

Without a key the NVD allows 5 requests per 30 seconds (the Actor waits accordingly). A free key from nvd.nist.gov makes runs with many keywords much faster.

## `stateStoreName` (type: `string`):

Named key-value store that remembers delivered CVEs and KEV entries. Use different names for different watch lists.

## Actor input object example

```json
{
  "mode": "cve_keywords",
  "keywords": [
    "openssl",
    "nginx"
  ],
  "lookbackDays": 7,
  "dateField": "published",
  "minSeverity": "NONE",
  "maxCvesPerKeyword": 200,
  "onlyKev": false,
  "onlyNew": true,
  "firstRunMode": "baseline",
  "stateStoreName": "cve-kev-monitor-state"
}
```

# Actor output Schema

## `vulnerabilities` (type: `string`):

No description

## `summary` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "keywords": [
        "openssl",
        "nginx"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("thequietstack/cve-kev-monitor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "keywords": [
        "openssl",
        "nginx",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("thequietstack/cve-kev-monitor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "keywords": [
    "openssl",
    "nginx"
  ]
}' |
apify call thequietstack/cve-kev-monitor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,thequietstack/cve-kev-monitor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Th10D1zPkDZdnypUh/builds/X5vIB04Zaoh1W1IeL/openapi.json