# NVD CVE Normalizer — CVSS, CWE & Exploit Intelligence (`wakey7dev/nvd-cve-normalizer`) Actor

Search the NIST National Vulnerability Database and get clean, normalized CVE records — CVSS severity, CWE weakness names, affected vendor/product, and CISA Known Exploited Vulnerabilities (KEV) enrichment. Free, no key.

- **URL**: https://apify.com/wakey7dev/nvd-cve-normalizer.md
- **Developed by:** [Chris Wakefield](https://apify.com/wakey7dev) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per usage

This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

![Chris The Dev](https://raw.githubusercontent.com/chriswakefield87/appstore-screenshot-translator/main/assets/actor-banner.png)

## NVD CVE Vulnerability Normalizer — CVSS, CWE & Exploit Intelligence

Search the **NIST National Vulnerability Database (NVD)** and get clean, normalized CVE records ready for your security workflows. Every result is flattened and enriched — no more parsing raw CVSS vectors, CWE IDs or CPE strings by hand.

**Free API, no key required.** Optionally enrich with the **CISA Known Exploited Vulnerabilities (KEV)** catalogue to flag actively-exploited flaws.

### What this Actor does

- 🔍 **Flexible search** — by keyword, exact CVE ID, CPE product string, date range, or minimum CVSS severity
- 🧹 **Normalizes every CVE** into flat, machine-readable fields
- 🎯 **Extracts CVSS severity** (Critical/High/Medium/Low + numeric score) from v2/v3.x/v4 metrics
- 🏷️ **Maps CWE IDs to human-readable weakness names** (e.g. `CWE-79` → *Cross-site Scripting (XSS)*)
- 📦 **Parses CPE strings into vendor / product / version** for affected software
- 🚨 **CISA KEV enrichment** — flags known-exploited CVEs with due date, ransomware association, and required remediation action
- 🗂️ **Deduplicated references** with counts

### Input parameters

| Parameter | Type | Description |
|---|---|---|
| `keyword` | string | Keyword(s) searched in CVE descriptions (e.g. `log4j`) |
| `cveId` | string | Exact CVE ID, comma-separated (e.g. `CVE-2021-44228`) |
| `cpeName` | string | CPE 2.3 product string (e.g. `cpe:2.3:o:microsoft:windows_10`) |
| `severity` | select | Minimum severity — `CRITICAL`, `HIGH`, `MEDIUM`, `LOW` |
| `pubStartDate` | string | Only CVEs published on/after this date (`YYYY-MM-DD`) |
| `pubEndDate` | string | Only CVEs published on/before this date |
| `includeKnownExploited` | boolean | Enrich with CISA KEV (default `true`) |
| `nvdApiKey` | string | Optional free NVD API key (raises rate limit 5→50 req/30s) |
| `maxResults` | integer | Max CVEs to return (1–500, default 50) |

### Example input

```json
{
  "keyword": "log4j",
  "severity": "CRITICAL",
  "includeKnownExploited": true,
  "maxResults": 20
}
```

### Example output

```json
{
  "cveId": "CVE-2021-44228",
  "description": "Apache Log4j2 2.0-beta9 through 2.15.0 ... JNDI features ... do not protect against attacker controlled LDAP ...",
  "severity": "CRITICAL",
  "severityScore": 10.0,
  "cvssVersion": "3.1",
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "cweIds": ["CWE-502"],
  "cweNames": ["Deserialization of Untrusted Data"],
  "vendors": ["apache"],
  "products": ["log4j"],
  "affectedProducts": [
    { "cpe": "cpe:2.3:a:apache:log4j:2.15.0:*:*:*:*:*:*:*", "vendor": "apache", "product": "log4j", "version": "2.15.0", "vulnerable": true }
  ],
  "published": "2021-12-10T10:15:09.927",
  "lastModified": "2021-12-10T10:15:09.927",
  "referenceCount": 12,
  "knownExploited": true,
  "kevVendor": "Apache",
  "kevProduct": "Log4j2",
  "kevDateAdded": "2021-12-01",
  "kevDueDate": "2021-12-22",
  "kevRansomware": false,
  "kevRequiredAction": "For all affected software assets ... apply mitigations ..."
}
```

### Use cases

- **Vulnerability management** — feed clean CVE data into ticketing, SIEM, or asset-inventory systems
- **AppSec & pentesting** — quickly enumerate weaknesses for a product or tech stack
- **Threat intelligence** — prioritize CVEs that are actively exploited in the wild (CISA KEV)
- **Compliance** — evidence gathering for SOC 2, FedRAMP, PCI, and ISO 27001 audits
- **Security research** — trend analysis by severity, CWE class, vendor, or product

### Data sources

- **[NIST National Vulnerability Database (NVD)](https://nvd.nist.gov/)** — CVE records, CVSS metrics, CWE mappings, CPE configurations (public data, no key required)
- **[CISA Known Exploited Vulnerabilities (KEV)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)** — actively-exploited vulnerability catalogue (public data)

# Actor input Schema

## `keyword` (type: `string`):

Keyword(s) to search in CVE descriptions (e.g. 'log4j', 'remote code execution', 'Apache Struts'). Leave empty to use CVE ID, CPE, or date-range search.

## `cveId` (type: `string`):

Look up specific CVEs by ID (e.g. 'CVE-2021-44228'). Comma-separate multiple IDs. Takes precedence over keyword and CPE search.

## `cpeName` (type: `string`):

Find CVEs for a specific product via CPE 2.3 string (e.g. 'cpe:2.3:o:microsoft:windows\_10'). Takes precedence over keyword search.

## `severity` (type: `string`):

Only return CVEs at or above this CVSS v3 base severity.

## `pubStartDate` (type: `string`):

Only return CVEs published on or after this date.

## `pubEndDate` (type: `string`):

Only return CVEs published on or before this date.

## `includeKnownExploited` (type: `boolean`):

Flag CVEs in the CISA KEV catalogue and add vendor/product, due date, ransomware association and required action.

## `nvdApiKey` (type: `string`):

Optional free NVD API key to raise the rate limit from 5 to 50 requests/30s (faster runs). Get one free at nvd.nist.gov.

## `maxResults` (type: `integer`):

Maximum number of CVEs to return (1–500).

## Actor input object example

```json
{
  "keyword": "log4j",
  "severity": "",
  "includeKnownExploited": true,
  "maxResults": 50
}
```

# Actor output Schema

## `results` (type: `string`):

Complete dataset with all normalized CVE records.

## `summary` (type: `string`):

Human-readable summary table of the retrieved vulnerabilities.

## `stats` (type: `string`):

Machine-readable run statistics (severity counts, known-exploited count).

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "keyword": "log4j",
    "cveId": "",
    "cpeName": "",
    "pubStartDate": "",
    "pubEndDate": "",
    "nvdApiKey": ""
};

// Run the Actor and wait for it to finish
const run = await client.actor("wakey7dev/nvd-cve-normalizer").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "keyword": "log4j",
    "cveId": "",
    "cpeName": "",
    "pubStartDate": "",
    "pubEndDate": "",
    "nvdApiKey": "",
}

# Run the Actor and wait for it to finish
run = client.actor("wakey7dev/nvd-cve-normalizer").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "keyword": "log4j",
  "cveId": "",
  "cpeName": "",
  "pubStartDate": "",
  "pubEndDate": "",
  "nvdApiKey": ""
}' |
apify call wakey7dev/nvd-cve-normalizer --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,wakey7dev/nvd-cve-normalizer"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/c0X5rDBFmBnqpCfW2/builds/1BuNzl1i4ZKTQJyfv/openapi.json