# NVD CVE Vulnerability Intelligence (`wakey7dev/nvd-cve-normalizer`) Actor

Search NIST NVD for CVE vulnerabilities — CVSS scores, affected products, patches. Cybersecurity research, vulnerability management, threat intelligence.

- **URL**: https://apify.com/wakey7dev/nvd-cve-normalizer.md
- **Developed by:** [Chris Wakefield](https://apify.com/wakey7dev) (community)
- **Categories:** Developer tools
- **Features:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per usage

This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-usage

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

![Chris The Dev](https://raw.githubusercontent.com/chriswakefield87/appstore-screenshot-translator/main/assets/actor-banner.png)

## NVD CVE Vulnerability Normalizer — CVSS, CWE & Exploit Intelligence

Search the **NIST National Vulnerability Database (NVD)** and get clean, normalized CVE records ready for your security workflows. Every result is flattened and enriched — no more parsing raw CVSS vectors, CWE IDs or CPE strings by hand.

**Free API, no key required.** Optionally enrich with the **CISA Known Exploited Vulnerabilities (KEV)** catalogue to flag actively-exploited flaws.

### What this Actor does

- 🔍 **Flexible search** — by keyword, exact CVE ID, CPE product string, date range, or minimum CVSS severity
- 🧹 **Normalizes every CVE** into flat, machine-readable fields
- 🎯 **Extracts CVSS severity** (Critical/High/Medium/Low + numeric score) from v2/v3.x/v4 metrics
- 🏷️ **Maps CWE IDs to human-readable weakness names** (e.g. `CWE-79` → *Cross-site Scripting (XSS)*)
- 📦 **Parses CPE strings into vendor / product / version** for affected software
- 🚨 **CISA KEV enrichment** — flags known-exploited CVEs with due date, ransomware association, and required remediation action
- 🗂️ **Deduplicated references** with counts

### Input parameters

| Parameter | Type | Description |
|---|---|---|
| `keyword` | string | Keyword(s) searched in CVE descriptions (e.g. `log4j`) |
| `cveId` | string | Exact CVE ID, comma-separated (e.g. `CVE-2021-44228`) |
| `cpeName` | string | CPE 2.3 product string (e.g. `cpe:2.3:o:microsoft:windows_10`) |
| `severity` | select | Minimum severity — `CRITICAL`, `HIGH`, `MEDIUM`, `LOW` |
| `pubStartDate` | string | Only CVEs published on/after this date (`YYYY-MM-DD`) |
| `pubEndDate` | string | Only CVEs published on/before this date |
| `includeKnownExploited` | boolean | Enrich with CISA KEV (default `true`) |
| `nvdApiKey` | string | Optional free NVD API key (raises rate limit 5→50 req/30s) |
| `maxResults` | integer | Max CVEs to return (1–500, default 50) |

### Example input

```json
{
  "keyword": "log4j",
  "severity": "CRITICAL",
  "includeKnownExploited": true,
  "maxResults": 20
}
```

### Example output

```json
{
  "cveId": "CVE-2021-44228",
  "description": "Apache Log4j2 2.0-beta9 through 2.15.0 ... JNDI features ... do not protect against attacker controlled LDAP ...",
  "severity": "CRITICAL",
  "severityScore": 10.0,
  "cvssVersion": "3.1",
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "cweIds": ["CWE-502"],
  "cweNames": ["Deserialization of Untrusted Data"],
  "vendors": ["apache"],
  "products": ["log4j"],
  "affectedProducts": [
    { "cpe": "cpe:2.3:a:apache:log4j:2.15.0:*:*:*:*:*:*:*", "vendor": "apache", "product": "log4j", "version": "2.15.0", "vulnerable": true }
  ],
  "published": "2021-12-10T10:15:09.927",
  "lastModified": "2021-12-10T10:15:09.927",
  "referenceCount": 12,
  "knownExploited": true,
  "kevVendor": "Apache",
  "kevProduct": "Log4j2",
  "kevDateAdded": "2021-12-01",
  "kevDueDate": "2021-12-22",
  "kevRansomware": false,
  "kevRequiredAction": "For all affected software assets ... apply mitigations ..."
}
```

### Use cases

- **Vulnerability management** — feed clean CVE data into ticketing, SIEM, or asset-inventory systems
- **AppSec & pentesting** — quickly enumerate weaknesses for a product or tech stack
- **Threat intelligence** — prioritize CVEs that are actively exploited in the wild (CISA KEV)
- **Compliance** — evidence gathering for SOC 2, FedRAMP, PCI, and ISO 27001 audits
- **Security research** — trend analysis by severity, CWE class, vendor, or product

### Data sources

- **[NIST National Vulnerability Database (NVD)](https://nvd.nist.gov/)** — CVE records, CVSS metrics, CWE mappings, CPE configurations (public data, no key required)
- **[CISA Known Exploited Vulnerabilities (KEV)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)** — actively-exploited vulnerability catalogue (public data)

# Actor input Schema

## `keyword` (type: `string`):

Keyword(s) to search in CVE descriptions (e.g. 'log4j', 'remote code execution', 'Apache Struts'). Leave empty to use CVE ID, CPE, or date-range search.

## `cveId` (type: `string`):

Look up specific CVEs by ID (e.g. 'CVE-2021-44228'). Comma-separate multiple IDs. Takes precedence over keyword and CPE search.

## `cpeName` (type: `string`):

Find CVEs for a specific product via CPE 2.3 string (e.g. 'cpe:2.3:o:microsoft:windows_10'). Takes precedence over keyword search.

## `severity` (type: `string`):

Only return CVEs at or above this CVSS v3 base severity.

## `pubStartDate` (type: `string`):

Only return CVEs published on or after this date.

## `pubEndDate` (type: `string`):

Only return CVEs published on or before this date.

## `includeKnownExploited` (type: `boolean`):

Flag CVEs in the CISA KEV catalogue and add vendor/product, due date, ransomware association and required action.

## `nvdApiKey` (type: `string`):

Optional free NVD API key to raise the rate limit from 5 to 50 requests/30s (faster runs). Get one free at nvd.nist.gov.

## `maxResults` (type: `integer`):

Maximum number of CVEs to return (1–500).

## Actor input object example

```json
{
  "keyword": "log4j",
  "cveId": "",
  "cpeName": "",
  "severity": "",
  "pubStartDate": "",
  "pubEndDate": "",
  "includeKnownExploited": true,
  "nvdApiKey": "",
  "maxResults": 50
}
```

# Actor output Schema

## `results` (type: `string`):

Complete dataset with all normalized CVE records.

## `summary` (type: `string`):

Human-readable summary table of the retrieved vulnerabilities.

## `stats` (type: `string`):

Machine-readable run statistics (severity counts, known-exploited count).

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "keyword": "log4j",
    "cveId": "",
    "cpeName": "",
    "pubStartDate": "",
    "pubEndDate": "",
    "nvdApiKey": ""
};

// Run the Actor and wait for it to finish
const run = await client.actor("wakey7dev/nvd-cve-normalizer").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "keyword": "log4j",
    "cveId": "",
    "cpeName": "",
    "pubStartDate": "",
    "pubEndDate": "",
    "nvdApiKey": "",
}

# Run the Actor and wait for it to finish
run = client.actor("wakey7dev/nvd-cve-normalizer").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "keyword": "log4j",
  "cveId": "",
  "cpeName": "",
  "pubStartDate": "",
  "pubEndDate": "",
  "nvdApiKey": ""
}' |
apify call wakey7dev/nvd-cve-normalizer --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,wakey7dev/nvd-cve-normalizer"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/c0X5rDBFmBnqpCfW2/builds/1BuNzl1i4ZKTQJyfv/openapi.json