Security Vulnerability Feed Aggregator

Security Vulnerability Feed Aggregator pulls structured data from NVD, CISA KEV & FIRST EPSS and returns it as a clean dataset you can export as JSON, CSV or Excel. It queries the NVD CVE API by keyword, cross-references the CISA Known Exploited Vulnerabilities catalog and enriches every record with a FIRST EPSS exploitation-probability score, then returns one merged row per CVE.

No API key, no login. Click Start and it works with the prefilled input.

What does Security Vulnerability Feed Aggregator do?

It queries NVD, CISA KEV & FIRST EPSS and returns one row per record, with only the fields that matter. Runs on the Apify platform, so you get an API endpoint, scheduling, monitoring and integrations (Zapier, Make, Google Sheets, webhooks) without maintaining any infrastructure.

Why use it?

• NVD, CISA KEV & FIRST EPSS data without the plumbing: no proxy setup, no pagination code, no scraping maintenance.
• Schedule it to monitor changes daily or weekly and trigger alerts on new records.
• Feed it straight into a spreadsheet, database, or an AI agent via the Apify API or MCP server.
• Runs in seconds and returns a typed dataset that is ready for analysis.

How to use it

1. Click Try for free / Start.
2. Leave the default input to see a sample run, or type your own values (see Input below).
3. Press Start and wait a few seconds.
4. Open the Output tab and download as JSON, CSV, Excel or HTML.

Input

Field	Type	Default	Description
query	string	"log4j"	Vendor, product or keyword to search in the NVD CVE API. Empty returns recent known-exploited CVEs.
maxResults	integer	20	Maximum number of CVE records to return.

Example input:

{
  "query": "log4j",
  "maxResults": 5
}

Output

One item per record. Sample:

{
  "cve_id": "CVE-2021-44228",
  "severity": "CRITICAL",
  "cvss_score": 10.0,
  "cvss_version": "V31",
  "epss_score": 0.99999,
  "epss_percentile": 1.0
}

You can download the dataset in various formats such as JSON, HTML, CSV, or Excel.

Data fields

Field	Type	Meaning
cve_id	string	CVE ID
severity	string	Severity
cvss_score	number	CVSS Score
cvss_version	string	CVSS Version
epss_score	number	EPSS Score
epss_percentile	number	EPSS Percentile
exploited_in_wild	boolean	Exploited In Wild
kev_vendor	string	KEV Vendor
kev_product	string	KEV Product
kev_date_added	string	Added To KEV
kev_due_date	string	Remediation Due
kev_required_action	string	Required Action
ransomware_use	string	Ransomware Use
published	string	Published
last_modified	string	Last Modified
description	string	Description
references	string	References
nvd_url	string	NVD Record
primary_source	string	Primary Source

How much does it cost to run?

This Actor uses pay-per-event pricing: you pay per result item pushed to the dataset, and nothing for an empty run. Each run is a few seconds of compute, so typical costs are fractions of a cent per run, and the Apify free tier covers plenty of testing.

Tips and advanced options

• Raise maxResults for a bigger pull; the Actor pages through the source for you.
• Schedule it (e.g. every morning) and combine with a webhook to get only the new records.
• Add the Actor to an AI agent through the Apify MCP server for natural-language queries.

FAQ, disclaimers and support

• Is this legal? It uses publicly available data from NVD, CISA KEV & FIRST EPSS. You are responsible for how you use the data and for complying with the source's terms.
• It returned nothing? Try a vendor or product keyword such as 'log4j', 'chrome' or 'wordpress'. Leave it empty to get the most recently exploited CVEs.
• Something broken? Open an issue on the Actor's Issues tab. Data sources change and get fixed quickly.
• Need a custom variant (extra fields, a different source, a scheduled report)? Get in touch through the Issues tab.