CVE Vulnerability Intelligence API

Search NIST NVD CVE 2.0 data and enrich every normalized vulnerability with CISA Known Exploited Vulnerabilities context.

This production candidate supports exact CVE lookup and bounded filtered search while requiring no NVD API key, CISA key, browser, login, cookie, or proxy.

Search modes

Exact lookup uses cveIds and takes precedence over search filters.

Search mode supports:

• keyword search,
• CVSS v3 severity,
• CISA KEV-only filtering,
• NVD publication-date windows,
• bounded pagination.

Publication windows require both start and end values and are rejected when they exceed NVD's 120-day maximum.

The Actor caps maxResults at 500 and pageSize at 100 even though the upstream NVD API permits larger pages. This keeps keyless runtime and billing predictable.

Keyless NVD pacing

NVD's anonymous API has a tighter request limit than API-key traffic. The Actor therefore spaces NVD calls by at least 6.2 seconds. It does not ask customers for an NVD API key.

Output

Each row includes CVE metadata, best available CVSS, CWE IDs, references, direct NVD URL, and CISA KEV enrichment.

knownExploited=true is based on the live CISA KEV catalog. KEV rows can also include date-added, remediation due date, ransomware campaign use, and required action.

Pagination

Search pagination uses NVD's resultsPerPage and startIndex contract. The Actor stops when it reaches the customer's maximum unique result count or the upstream result set ends.

Data sources

• NIST NVD CVE API 2.0
• CISA Known Exploited Vulnerabilities JSON catalog

Both are public sources. This Actor does not infer active exploitation from CVSS severity. Active exploitation is represented only by the official KEV join.

CVSS v3 filter semantics

NVD's cvssV3Severity search filter is specifically a CVSS v3.x filter. A CVE can also contain CVSS v4.0 metrics whose qualitative severity differs from its CVSS v3.x severity.

For that reason this Actor exposes two layers:

• cvssVersion, cvssScore, severity, vectorString: best available metric, preferring CVSS v4.0 when present.
• cvssV3Version, cvssV3Score, cvssV3Severity, cvssV3Vector: explicit CVSS v3.x metric.

When you search with severity=CRITICAL, validate the filter meaning against cvssV3Severity. The best-available severity may legitimately differ when a newer CVSS v4.0 metric exists.

Pricing and billing

This Actor uses Apify pay-per-event pricing.

The primary billable result event is cve-result. One event corresponds to one normalized CVE record successfully written to the default Dataset. The platform's synthetic apify-actor-start event is charged separately at run start.

Billing is event-specific and tied directly to Dataset emission. If the Apify event charge limit is reached, the Actor stops emitting additional paid result rows.

Empty/default input behavior

The Actor is intentionally runnable with no custom input.

If the customer starts the Actor with an empty object ({}), it performs one exact lookup for CVE-2021-44228 and emits one normalized result. The Store input form uses the same CVE as its default.

This demo fallback exists only when all search selectors are absent. Any customer-supplied cveIds, keyword, severity, KEV-only flag, or publication window takes precedence and preserves the normal production search behavior.

The fallback is bounded to one CVE row, so an accidental default Start is useful, deterministic, and low-cost rather than a terminal validation failure.