# Vulnerability & Security Intel Scraper (`parseforge/vulnerability-security-intel-scraper`) Actor

Aggregates vulnerability records, exploits, malware URLs, and OpenSSF Scorecard results from five public sources. Returns each finding as a flat row for analysis and export.

- **URL**: https://apify.com/parseforge/vulnerability-security-intel-scraper.md
- **Developed by:** [ParseForge](https://apify.com/parseforge) (community)
- **Categories:** Developer tools, Other
- **Stats:** 3 total users, 1 monthly users, 90.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$21.00 / 1,000 result items

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

[![ParseForge](https://raw.githubusercontent.com/ParseForge/apify-assets/main/banner.jpg)](https://apify.com/parseforge?fpr=vmoqkp)

### Vulnerability & Security Intel Scraper

**Aggregate vulnerability and security intelligence from GHSA, MITRE, Exploit-DB, OpenSSF Scorecard, and URLhaus in one run.** Each result includes CVE IDs, severity scores, exploit availability, and package or URL indicators. No API keys required. Export to CSV, JSON, Excel, or XML.

Security teams spend hours jumping between the National Vulnerability Database, GitHub Advisories, Exploit-DB, and threat intel feeds to answer one question: is this CVE or dependency dangerous right now. This actor queries five sources in parallel, normalizes the results, and returns a single dataset you can filter and export. It covers CVEs, exploits, malware URLs, and OpenSSF Scorecard metrics for your own repositories.

| Who uses it | What they scrape Vulnerability & Security Intel Aggregator for |
|---|---|
| SOC analysts | Triage the latest CVEs against active exploit and malware intelligence in one query. |
| Application security engineers | Audit internal repositories with OpenSSF Scorecard and cross-reference dependencies against known vulnerabilities. |
| Threat researchers | Monitor new exploit publications and malicious URL submissions for a specific product or keyword. |
| Compliance teams | Generate a snapshot of vulnerability exposure across your software supply chain for audit evidence. |

### What it does

This Actor collects vulnerability records, exploit entries, malware URLs, and OpenSSF Scorecard results by CVE ID, keyword, or repository URL, and returns each finding as a flat row.

- 🛡️ **Multi-source aggregation:** GHSA, MITRE CVE, Exploit-DB, OpenSSF Scorecard, and URLhaus queried in parallel.
- 🔍 **CVE and keyword search:** Drive the actor with a CVE ID like CVE-2024-1234 or a product keyword like 'log4j'.
- 📊 **OpenSSF Scorecard:** Supply a list of GitHub repository URLs and receive their security posture scores.
- 🌐 **Malware URL intelligence:** Pull the latest malicious URLs from URLhaus for domain or IP indicators.
- ⚙️ **Configurable volume:** Set a maximum items limit from 1 up to 1,000,000 per run.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

### What you can do with Vulnerability & Security Intel Aggregator data

**🚨 Triage a critical CVE.**

A SOC analyst enters a new CVE ID and immediately sees the GHSA advisory, any public exploits, and whether the vulnerability appears in active malware campaigns.

**📋 Audit repository security posture.**

An AppSec engineer runs a list of internal GitHub repositories through OpenSSF Scorecard and cross-references the results with known CVEs for their dependencies.

**🔎 Monitor exploit availability for a product.**

A threat researcher searches Exploit-DB and URLhaus by a product keyword each morning to catch new attack tooling and malicious infrastructure.

**📦 Assess a package before adoption.**

A developer checks a third-party library name against GHSA and MITRE to see its vulnerability history before adding it to the project.

### Why choose this scraper

| | What you get |
|---|---|
| **Normalized schema** | CVE, GHSA, exploit, malware, and scorecard data in one consistent format. |
| **No API keys** | Reads public feeds directly; no registration or API token required. |
| **Parallel execution** | Five sources queried simultaneously for faster collection. |
| **Supply chain visibility** | Score your own repos and check dependencies in the same workflow. |

### How it compares

This actor aggregates five distinct security intelligence sources, while Package Intel focuses on npm and PyPI package metadata with OSV.dev vulnerability signals.

| Feature | ParseForge | Package Intel |
|---|---|---|
| GHSA advisory data | Yes | Not listed |
| MITRE CVE records | Yes | Not listed |
| Exploit-DB entries | Yes | Not listed |
| OpenSSF Scorecard metrics | Yes | Not listed |
| URLhaus malware URLs | Yes | Not listed |
| Package vulnerability signals | Not listed | Yes |

### Configure the run

Drive the Actor with a CVE ID, a keyword, or a list of GitHub repositories, and set a maximum number of results to control the run size. The Input tab lists every parameter.

A first run with the defaults:

```json
{
 "maxItems": 10
}
```

A larger pull:

```json
{
 "maxItems": 200
}
```

### Pricing

Pay-per-result: **$0.021 per result** collected. You pay only for the results written to your dataset.

| Results collected | Approximate cost |
|---|---|
| 100 results | $2.10 |
| 1,000 results | $21.00 |
| 10,000 results | $210.00 |

New Apify accounts start with $5 in free credit.

### Free users

Free-plan runs return up to 10 results as a preview. [Upgrade your Apify plan](https://console.apify.com/sign-up?fpr=vmoqkp) to collect up to 1,000,000 results per run.

### Run it

1. [Create a free Apify account with $5 in credit](https://console.apify.com/sign-up?fpr=vmoqkp).
2. Open the [Vulnerability & Security Intel Scraper](https://apify.com/parseforge/vulnerability-security-intel-scraper?fpr=vmoqkp).
3. Set your inputs and any filters, then click **Start**.
4. Export the results as CSV, Excel, JSON, or XML from the **Dataset** tab.

Run it programmatically through the [Apify API](https://docs.apify.com/api/v2) (`run-sync-get-dataset-items`) or the [ApifyClient](https://docs.apify.com/api/client/js) for JavaScript and Python.

### Use with AI agents (MCP)

Give an AI agent live access to Vulnerability & Security Intel Aggregator through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

```bash
claude mcp add --transport http apify "https://mcp.apify.com/?tools=parseforge/vulnerability-security-intel-scraper"
```

Then prompt it in plain language to run the scraper and read back the results.

### Troubleshooting

**Why am I getting no results for my CVE query?**

Check that you have selected at least one source that contains CVE records, such as GHSA or MITRE. Also verify the CVE ID format is correct, for example CVE-2024-1234.

**The OpenSSF Scorecard source returns an error for my repository.**

Ensure the repository URL is public and uses the format 'github.com/owner/repo'. Private repositories and organizations with restricted API access will not return results.

**My run is taking a long time.**

Querying multiple sources in parallel with a high maximum items value can take time. Reduce the 'Maximum vulnerabilities' number or deselect sources you do not need.

**I see duplicate entries in my dataset.**

The same vulnerability can appear across multiple sources. The actor returns each source's record separately so you can compare them. Use a deduplication step in your downstream processing if needed.

**The URLhaus source returns data but my keyword filter did not seem to apply.**

The keyword filter is applied to GHSA, MITRE, and Exploit-DB. URLhaus returns its most recent submissions unfiltered by keyword. Filter the dataset after the run for URLhaus-specific terms.

### FAQ

| Question | Answer |
|---|---|
| Which sources does this actor query? | It queries GitHub Security Advisories (GHSA), the MITRE CVE List, Exploit-DB, the OpenSSF Scorecard API, and URLhaus by abuse.ch. You select which sources to include in each run. |
| Do I need API keys for any of these sources? | No. All five sources are accessed through their public interfaces. No registration, API key, or authentication is required. |
| Can I search by something other than a CVE ID? | Yes. The query field accepts any keyword. It is applied to the sources that support free-text search: GHSA, MITRE, and Exploit-DB. |
| How do I get OpenSSF Scorecard results for my own repositories? | Add your repository URLs to the OpenSSF Repos input field. The actor queries the OpenSSF Scorecard API for each one and returns the scores and checks. |
| What does the URLhaus source return? | It returns the most recent malicious URL submissions, including the URL, threat type, tags, and the date it was reported. |
| How many results can I collect in one run? | You set the maximum with the 'Maximum vulnerabilities' field. The allowed range is 1 to 1,000,000 items. |
| What output formats are supported? | You can export your dataset to CSV, JSON, Excel, or XML from the Apify platform. |
| Does this actor check my own software for vulnerabilities? | It does not scan your code. It collects public vulnerability and threat intelligence data. You can use the OpenSSF Scorecard source to assess the security practices of public GitHub repositories you specify. |
| Can I schedule this actor to run daily? | Yes. Apify supports scheduled runs. You can configure this actor to collect fresh intelligence on a cron schedule. |
| Is the data from all sources normalized? | Yes. Each source returns a different shape natively, but the actor maps every result into a single flat schema so you can analyze them together. |

### Related actors

Browse the full [ParseForge collection](https://apify.com/parseforge?fpr=vmoqkp) for more scrapers.

🆘 **Need help?** Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ **Disclaimer.** This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by the respective sources (GitHub, MITRE, Exploit-DB, OpenSSF, abuse.ch). It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.

# Actor input Schema

## `query` (type: `string`):

Keyword applied to sources that support search (GHSA, MITRE, Exploit-DB).

## `sources` (type: `array`):

Which security intel sources to query in parallel.

## `maxItems` (type: `integer`):

How many vulnerabilities to collect per run.

## `openssfRepos` (type: `array`):

Repos to query against OpenSSF Scorecard (e.g. github.com/expressjs/express).

## Actor input object example

```json
{
  "query": "",
  "sources": [
    "ghsa",
    "mitre",
    "exploitdb",
    "openssf",
    "urlhaus"
  ],
  "maxItems": 10,
  "openssfRepos": [
    "github.com/expressjs/express",
    "github.com/facebook/react",
    "github.com/nodejs/node"
  ]
}
```

# Actor output Schema

## `results` (type: `string`):

Aggregated vulnerability and security intelligence from 5 sources.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "maxItems": 10
};

// Run the Actor and wait for it to finish
const run = await client.actor("parseforge/vulnerability-security-intel-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "maxItems": 10 }

# Run the Actor and wait for it to finish
run = client.actor("parseforge/vulnerability-security-intel-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "maxItems": 10
}' |
apify call parseforge/vulnerability-security-intel-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,parseforge/vulnerability-security-intel-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/euffbYU8Te07etOPe/builds/duHuZbFlcFDrG4XC0/openapi.json