[DEVELOPER TOOLS · AUTOMATION]

CVE Scraper: NVD Vulnerabilities, CVSS & KEV

Scrape NVD CVE data by product, CVE ID, severity or date: CVSS scores, CWE weaknesses, affected CPEs and CISA KEV status. Export CSV, JSON, Excel.

Input: 10 fields, none required. Billed per event on the free Apify plan: CVE record $0.015, CWE weaknesses $0.01, References $0.01 and 1 more event. Results export as JSON, CSV or Excel. Last updated 2026-10-04.

Run on Apify Need a custom version

STATUS: PRODUCTION
INPUT FIELDS: 10
REQUIRED: 0
PRICING: PAY PER EVENT
UPDATED: 2026-10-04
OUTPUT: JSON, CSV, Excel

01 / INPUT

What you can configure.

FIELDTYPEDESCRIPTION

KeywordskeywordsarraySearch the NVD CVE database by product, vendor or technology keyword (for example "openssl", "fortinet vpn", "wordpress plugin"). One NVD search runs per keyword. Leave empty if you use CVE IDs or filters instead.

Specific CVE IDscveIdsarrayLook up exact CVE identifiers such as CVE-2021-44228. These run first, in addition to any keyword searches. Unknown or malformed IDs produce a free error row. default: []

Max ItemsmaxItemsintegerMaximum number of CVE records to return (each one is billed as one CVE record). Free Apify users are limited to 10 (preview); paid users can set up to 1,000,000. Defaults to 10. default: 10

CVSS v3 severityseveritystringReturn only CVEs with this CVSS v3 base severity: LOW, MEDIUM, HIGH or CRITICAL. Leave on Any severity to return all. default: ""

Only CISA KEV (actively exploited)onlyKnownExploitedbooleanReturn only vulnerabilities listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, i.e. actively exploited in the wild. default: false

Published after (YYYY-MM-DD)publishedAfterstringStart of the publication date range, format YYYY-MM-DD. NVD allows ranges of at most 120 days; if Published before is empty, the range ends at the earlier of today or 120 days after this date. default: ""

Published before (YYYY-MM-DD)publishedBeforestringEnd of the publication date range, format YYYY-MM-DD. Requires Published after, and the range must be 120 days or less. default: ""

CWE weaknessesincludeWeaknessesbooleanAttach the CWE weakness classification per CVE. Billed per CVE when present. default: true

ReferencesincludeReferencesbooleanAdvisory and patch links with tags per CVE. Billed per CVE when present. default: true

Affected products (CPEs)includeConfigurationsbooleanAffected product/version criteria (CPE strings, up to 50 per CVE). Billed per CVE when present. default: false

02 / PRICING

Pay for what you collect.

EVENTDETAILPRICE

CVE record · BASEOne vulnerability with CVSS v3 score, vector, severity, KEV status and dates.$0.015

CWE weaknessesWeakness classification (CWE) for one CVE.$0.01

ReferencesAdvisory, patch and exploit links with tags for one CVE.$0.01

Affected products (CPEs)Affected product/version criteria for one CVE, up to 50 CPE strings.$0.01

Prices in USD, shown for the Apify free plan. Paid Apify plans get tiered discounts. Platform usage is included.

03 / FAQ

About the CVE Scraper.

How much does the CVE Scraper cost?

It charges per event: CVE record $0.015, CWE weaknesses $0.01, References $0.01 and 1 more event. Prices are for the free Apify plan, and paid Apify plans get tiered discounts. Apify platform usage is included in the event price.

What input does the CVE Scraper need?

No field is required. The Actor has 10 input fields and every one has a default.

Which formats can I export the CVE Scraper results in?

Results are saved to an Apify dataset. Download them as JSON, CSV or Excel, or fetch them through the Apify API.

04 / RELATED