NVD CVE Vulnerability Scraper (CVSS, CWE, CPE)

NVD CVE Vulnerability Scraper (CVSS, CWE, CPE)

The most complete NVD CVE scraper available. It returns every field the National Vulnerability Database exposes for each vulnerability, including the CVSS score, severity, version and vector, the CWE weakness list, the affected-product CPE list and every reference URL, and gives you keyword, date-range and exact-ID lookup to target exactly the CVEs you need.

Here is one real result, with every field the actor returns:

{
  "cveId": "CVE-1999-1237",
  "published": "1999-06-06T04:00:00.000",
  "lastModified": "2026-06-16T21:50:00.657",
  "vulnStatus": "Modified",
  "description": "Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows remote attackers to execute arbitrary commands via (1) a long username, (2) a long password, and (3) other unspecified methods.",
  "cvssV3Score": 10,
  "cvssSeverity": "HIGH",
  "cvssVersion": "2.0",
  "cvssVector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "cwe": ["CWE-120"],
  "sourceIdentifier": "cve@mitre.org",
  "references": [
    "http://www.securityfocus.com/archive/1/14384",
    "https://exchange.xforce.ibmcloud.com/vulnerabilities/2272"
  ],
  "affectedProducts": ["cpe:2.3:a:apache:http_server:-:*:*:*:*:*:*:*"],
  "url": "https://nvd.nist.gov/vuln/detail/CVE-1999-1237",
  "source": "National Vulnerability Database",
  "observedAt": "2026-08-10T14:31:59.367Z"
}

What it does

The actor queries the NIST National Vulnerability Database (NVD), applies the filters you pass as input, paginates through the matching CVEs, and writes one normalized record per vulnerability to the run's dataset. You can search by keyword against the vulnerability description, restrict to a published date range, or fetch one exact vulnerability by its CVE ID.

Quickstart

Open the actor, paste this into the input, and press Run. It returns up to 10 CVEs matching "apache".

{
  "keyword": "apache",
  "maxCVEs": 10
}

Billing and limits

• Pay per result. You are charged per CVE record returned (result event). See the pricing tab for the current per-result price.
• No charge on failure. If a run errors, the actor writes a single item with a populated error field and does not charge for it. Empty runs cost nothing.
• Spend cap respected. Set maxTotalChargeUsd on the run; once reached, the actor stops emitting and charging further billable results.
• Free Apify plans are capped at 10 records per run. Upgrade for higher maxCVEs.
• Source date-range limit. When using pubStartDate and pubEndDate, the NVD API requires both and limits the window to 120 days per query. For longer histories, split the work into consecutive windows.

FAQ and troubleshooting

A run returned 0 records. Why? The keyword or date range matched no CVEs. Try a broader keyword or a different window. Zero-result runs are not charged.

How do I fetch one exact vulnerability? Set cveId to the exact identifier, for example CVE-2021-44228. The other filters are then ignored.

Which CVSS version does cvssV3Score use? The actor reports the best available metric and records which version it came from in cvssVersion (for example 3.1, 3.0 or 2.0). The matching vector is in cvssVector.

Is this an official NIST tool? No. This actor is independent and has no affiliation with NIST or the NVD. It reads only data that is publicly available through the National Vulnerability Database.