NVD CVE Scraper: Vulnerabilities by Vendor and Severity

NVD CVE Tracker: by Vendor, Product, Severity

Pull newly-published or newly-modified CVEs from NIST NVD. Filter by vendor/product (CPE 2.3), severity, CWE, or keyword. One clean row per CVE: id, description, CVSS v3 score & vector, CWEs, affected CPEs, references, NVD URL.

Built for cron: pass sinceDays: 1 for a daily AppSec watchlist of your tech stack.

Inputs

{
  "keywords": ["openssl", "cisco asa"],
  "cpeFilters": ["cpe:2.3:a:apache:*:*:*:*:*:*:*:*:*"],
  "severityFilters": ["HIGH", "CRITICAL"],
  "sinceDays": 7,
  "maxResultsPerQuery": 200
}

input	default	notes
keywords	none	Keyword searches over CVE descriptions. Each is a separate query.
cpeFilters	none	CPE 2.3 match strings (wildcards allowed). Each is a separate query.
severityFilters	all	Limit to LOW, MEDIUM, HIGH, CRITICAL (CVSS v3).
cweId	none	Optional CWE filter (e.g. CWE-89).
sinceDays	7	Modified in the last sinceDays days. NVD max window is 120 days.
maxResultsPerQuery	200	Cap per keyword/CPE query. NVD page size up to 2000.
apiKey	none	Optional NVD API key: boosts rate from 5/30s to 50/30s.

Output

One row per CVE (deduplicated across keyword/CPE queries):

field	example
cveId	CVE-2026-12345
published	2026-05-30T14:00:00.000
lastModified	2026-06-01T09:12:33.140
vulnStatus	Analyzed, Modified, Awaiting Analysis
description	In Apache HTTP Server <2.4.62, ...
cvssV3Version	3.1
cvssV3BaseScore	9.1
cvssV3Severity	CRITICAL
cvssV3VectorString	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
exploitabilityScore	3.9
impactScore	5.9
cvssV4BaseScore	8.7 (CVSS 4.0, when NVD or the CNA gives one)
cvssV4Severity	HIGH
cvssV4VectorString	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
cwes	["CWE-119", "CWE-787"]
affectedCpes	["cpe:2.3:a:apache:http_server:2.4.61:*:*:*:*:*:*:*"]
references	["https://www.openssl.org/news/secadv/20260530.txt", ...]
nvdUrl	https://nvd.nist.gov/vuln/detail/CVE-2026-12345
queryOrigin	kw=openssl sev=CRITICAL

Daily cron pattern

{
  "cpeFilters": [
    "cpe:2.3:a:apache:*:*:*:*:*:*:*:*:*",
    "cpe:2.3:a:nginx:*:*:*:*:*:*:*:*:*",
    "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
  ],
  "severityFilters": ["HIGH", "CRITICAL"],
  "sinceDays": 1
}

Real-world questions this answers

• AppSec triage. Daily firehose of HIGH+CRITICAL CVEs affecting our stack.
• Vendor watch. Anything new from Cisco / Microsoft / Red Hat?
• Supply-chain audit. New CVEs in a CPE-matched component.
• Vulnerability research. Filter by CWE for class-specific datasets.

What it doesn't do

• No Rejected CVE ids: NVD keeps them without a score or a real flaw.
• No EPSS / KEV enrichment yet (those are separate FIRST.org / CISA feeds; planned).
• No vendor advisory PDFs: just NVD-stored references.
• No exploit-availability flag (NVD doesn't expose exploit-db mapping reliably).

Pricing

Pay per event. Price per 1,000 events:

Event	Base price	Bronze	Silver	Gold
CVE extracted	$2.00	$1.80	$1.60	$1.40

Bronze, Silver and Gold are the discounts Apify gives users of its paid plans. The Pricing tab always shows the current prices.

Run it through the API

Python, with the apify-client package:

from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("v0iddo/nvd-cve-tracker").call(run_input={"maxResultsPerQuery": 20})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

JavaScript, with the apify-client package:

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: '<YOUR_APIFY_TOKEN>' });
const run = await client.actor('v0iddo/nvd-cve-tracker').call({"maxResultsPerQuery": 20});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

One HTTP call that waits for the run and returns the rows (for runs that finish within 5 minutes):

curl -X POST "https://api.apify.com/v2/acts/v0iddo~nvd-cve-tracker/run-sync-get-dataset-items?token=<YOUR_APIFY_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"maxResultsPerQuery": 20}'

Output fields, real sample rows, the price and this code for Python, JavaScript and cURL are also in the guide to this actor.

Use it from an agent (MCP)

Claude, Cursor, VS Code and other MCP clients can call this actor as a tool through the Apify MCP server. Add it to the client's MCP configuration:

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com?tools=v0iddo/nvd-cve-tracker",
      "headers": {
        "Authorization": "Bearer <YOUR_APIFY_TOKEN>"
      }
    }
  }
}

FAQ

Do I need an account, cookies or an API key?

No. The actor works without one. NVD API key (optional) is optional and stored as a secret input; the note under the field on the Input tab says when it helps.

How many results can one run return?

Set Max results per keyword/CPE query (up to 10,000) to the number you need. Large jobs can also be split into several runs or scheduled.

How am I charged?

Pay per event, at the prices on the Pricing tab for your Apify plan (the Pricing section of this page lists them). The platform usage of the run is included in those prices, and your spending limit for a run is always respected.

Why did my run return no results?

The status message and the log of the run say why: usually nothing matched the input, or the source did not answer for a moment. Check the input against the example above and run it again.

Can I run it on a schedule?

Yes. Save your input as a task and add a schedule in the Apify Console (daily, hourly or with a cron expression). Each run gets its own dataset, so you keep a history.

Which formats can I export?

JSON, CSV, Excel, XML, HTML table and RSS from the Output tab or the API. Integrations send the rows to Google Sheets, Slack, Make, Zapier, n8n or a webhook.

Is collecting this data allowed?

The actor collects data that the source publishes openly, without a login. Public data can still be personal data under laws such as the GDPR, and sources have their own terms: make sure your use of the data follows the rules that apply to you.

What happens when the source changes?

An automated test runs the actor every day on the example input and checks the rows, not only that the run finished. When a check fails, the actor is repaired and rebuilt; the build history on this page shows each update.

Something is missing or wrong. Where do I report it?

Open an issue on the Issues tab of this actor with the run link. Requests for a new field are welcome too.

Related actors

• npm Package Stats Scraper: Metadata and Downloads
• GitHub Trending Scraper: Repos by Language and Period
• GitHub Security Advisories Scraper by Ecosystem
• Product Hunt Scraper: Daily Launches
• App Store Scraper: App Details, Ratings, Prices
• App Store Reviews Scraper: Ratings and Reviews by Country

Maintained by

vøiddo studio: small independent shop.