CVE Lookup API: Severity, Fixed Versions & Exploited
Pricing
$2.00 / 1,000 vulnerability lookups
CVE Lookup API: Severity, Fixed Versions & Exploited
Look up any CVE, GHSA or OSV vulnerability: description, CVSS score and severity, CWE, affected packages with fixed versions, and whether CISA lists it as actively exploited (KEV).
Pricing
$2.00 / 1,000 vulnerability lookups
Rating
0.0
(0)
Developer
Tudor Lane
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
2 days ago
Last modified
Categories
Security
Limited permissionsShare
Use when: a security or coding agent needs the facts on a vulnerability fast: how bad (CVSS), what it affects, which version fixes it, and whether CISA lists it as actively exploited (KEV). Accepts CVE ids (NVD) and GHSA / PYSEC / RUSTSEC / GO ids (OSV), cross-linked via aliases.
Try this input (also the default, just click Start)
{"requests": ["CVE-2021-44228", "GHSA-jfh8-c2jp-5v3q"]}
Sample output (real run, 4 Nov 2026, trimmed)
{"id": "CVE-2024-3094", "aliases": ["GHSA-rxwq-x6h5-x525"], "summary": "Xz: malicious code in distributed source","cvss_score": 10, "severity": "CRITICAL", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "cwe": ["CWE-506"],"known_exploited": false, "kev": null, "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3094", "error": null}{"id": "CVE-2021-44228", "aliases": ["GHSA-jfh8-c2jp-5v3q"], "severity": "CRITICAL", "known_exploited": true,"kev": {"date_added": "2021-12-10", "due_date": "2021-12-24", "ransomware": "Known", "action": "Apply updates..."}, "error": null}
Output fields: description, CVSS score/severity/vector/version (v4.0, 3.1, 3.0 or 2), CWE ids, published/modified, affected_packages (ecosystem, package, introduced, fixed), CISA KEV block, references, NVD and OSV links.
Send many items in requests per run (up to 500; cheaper and faster than one run each). No API key needed.
Pricing: pay per event, $0.002 per vulnerability lookup. Not-found ids and errors are not charged. No subscription.
Limits & failure modes
- NVD allows 5 requests per 30 seconds without a key, so big batches are paced (about 12 CVEs a minute).
affected_packagescomes from OSV; for some CVEs (e.g. xz CVE-2024-3094) it only has git commit ranges, with no package name or fixed version.- Severity is the source's score, not a risk rating for your environment; always confirm on NVD.
- Sources: NIST NVD (public domain; "This product uses the NVD API but is not endorsed or certified by the NVD"), OSV.dev (CC BY 4.0), CISA KEV (public domain).
Last tested: 4 Nov 2026.
Use from AI agents (MCP)
- Apify MCP server: add
https://mcp.apify.com/?tools=tudorlane/cve-lookupto Claude, Cursor, ChatGPT, VS Code or any MCP client. - REST:
POST https://api.apify.com/v2/acts/tudorlane~cve-lookup/run-sync-get-dataset-items?token=YOUR_TOKENwith the input JSON.