NVD CVE Vulnerability Normalizer — CVSS, CWE & Exploit Intelligence

Search the NIST National Vulnerability Database (NVD) and get clean, normalized CVE records ready for your security workflows. Every result is flattened and enriched — no more parsing raw CVSS vectors, CWE IDs or CPE strings by hand.

Free API, no key required. Optionally enrich with the CISA Known Exploited Vulnerabilities (KEV) catalogue to flag actively-exploited flaws.

What this Actor does

• 🔍 Flexible search — by keyword, exact CVE ID, CPE product string, date range, or minimum CVSS severity
• 🧹 Normalizes every CVE into flat, machine-readable fields
• 🎯 Extracts CVSS severity (Critical/High/Medium/Low + numeric score) from v2/v3.x/v4 metrics
• 🏷️ Maps CWE IDs to human-readable weakness names (e.g. CWE-79 → Cross-site Scripting (XSS))
• 📦 Parses CPE strings into vendor / product / version for affected software
• 🚨 CISA KEV enrichment — flags known-exploited CVEs with due date, ransomware association, and required remediation action
• 🗂️ Deduplicated references with counts

Input parameters

Parameter	Type	Description
keyword	string	Keyword(s) searched in CVE descriptions (e.g. log4j)
cveId	string	Exact CVE ID, comma-separated (e.g. CVE-2021-44228)
cpeName	string	CPE 2.3 product string (e.g. cpe:2.3:o:microsoft:windows_10)
severity	select	Minimum severity — CRITICAL, HIGH, MEDIUM, LOW
pubStartDate	string	Only CVEs published on/after this date (YYYY-MM-DD)
pubEndDate	string	Only CVEs published on/before this date
includeKnownExploited	boolean	Enrich with CISA KEV (default true)
nvdApiKey	string	Optional free NVD API key (raises rate limit 5→50 req/30s)
maxResults	integer	Max CVEs to return (1–500, default 50)

Example input

{
  "keyword": "log4j",
  "severity": "CRITICAL",
  "includeKnownExploited": true,
  "maxResults": 20
}

Example output

{
  "cveId": "CVE-2021-44228",
  "description": "Apache Log4j2 2.0-beta9 through 2.15.0 ... JNDI features ... do not protect against attacker controlled LDAP ...",
  "severity": "CRITICAL",
  "severityScore": 10.0,
  "cvssVersion": "3.1",
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "cweIds": ["CWE-502"],
  "cweNames": ["Deserialization of Untrusted Data"],
  "vendors": ["apache"],
  "products": ["log4j"],
  "affectedProducts": [
    { "cpe": "cpe:2.3:a:apache:log4j:2.15.0:*:*:*:*:*:*:*", "vendor": "apache", "product": "log4j", "version": "2.15.0", "vulnerable": true }
  ],
  "published": "2021-12-10T10:15:09.927",
  "lastModified": "2021-12-10T10:15:09.927",
  "referenceCount": 12,
  "knownExploited": true,
  "kevVendor": "Apache",
  "kevProduct": "Log4j2",
  "kevDateAdded": "2021-12-01",
  "kevDueDate": "2021-12-22",
  "kevRansomware": false,
  "kevRequiredAction": "For all affected software assets ... apply mitigations ..."
}

Use cases

• Vulnerability management — feed clean CVE data into ticketing, SIEM, or asset-inventory systems
• AppSec & pentesting — quickly enumerate weaknesses for a product or tech stack
• Threat intelligence — prioritize CVEs that are actively exploited in the wild (CISA KEV)
• Compliance — evidence gathering for SOC 2, FedRAMP, PCI, and ISO 27001 audits
• Security research — trend analysis by severity, CWE class, vendor, or product

Data sources

• NIST National Vulnerability Database (NVD) — CVE records, CVSS metrics, CWE mappings, CPE configurations (public data, no key required)
• CISA Known Exploited Vulnerabilities (KEV) — actively-exploited vulnerability catalogue (public data)