CVE Vulnerability Feed: NVD, CISA KEV & EPSS

New and updated vulnerabilities from NVD with CVSS score and severity, CWE, affected vendors and products, references, CISA known-exploited status (date added, due date, ransomware use) and EPSS exploit likelihood. Filters by vendor, product, severity, CVSS, EPSS; alerts.

$3 per 1,000 vulnerabilityupdated 2026-10-30

Run it on Apify Build the input See the output

Try it

Build the input, get the call

Change any field; the code on the right follows. Copy it, or run the same input on Apify.

What to watch

NVD: every CVE published or modified in the window. KEV: CVEs CISA added to its known-exploited catalog in the window.

In the last N days

About 600-900 CVEs are published a day.

From date

YYYY-MM-DD; with To date replaces the days above.

To date

YYYY-MM-DD (default today).

Date

NVD only.

Keywords

Words in the CVE description, e.g. "remote code execution".

Filters

Vendors

e.g. microsoft, apache, cisco (matches affected vendors).

Products

e.g. windows, exchange server, log4j.

Severities

CRITICALHIGHMEDIUMLOW

Empty = all.

Min CVSS score

e.g. 7.

Known exploited only

Only CVEs in CISA's known-exploited catalog.

Min EPSS

Probability of exploitation in the next 30 days, 0 to 1, e.g. 0.1.

CVE ids

Look up these CVEs instead (e.g. CVE-2024-3400).

Max CVEs

Most CVEs returned per run.

Monitoring

Only new CVEs

Schedule the Actor and each run returns only CVEs earlier runs did not deliver: alerts for your vendors and products.

terminal

curl -X POST \
  "https://api.apify.com/v2/acts/tacps126~cve-feed/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"withinDays":2,"severities":["CRITICAL","HIGH"]}'

Up to 1,000 vulnerabilitys: at most $3, on Apify's free plan.

Output

What you get back

The fields every row has.

Field	What it holds
`cveId`, `url`, `published`, `lastModified`, `status`, `description`	The CVE
`cvssScore`, `severity`, `cvss` (vector, version, attack vector)	How bad it is
`cwe`	Weakness types
`vendors`, `products`, `cpes`	What is affected
`knownExploited`, `kev` (date added, due date, required action, ransomware use)	Exploited in the wild (CISA)
`epss`, `epssPercentile`	Chance of exploitation in the next 30 days (FIRST)
`publicExploitReference`, `references`	Advisories, patches, exploit links

Download as JSON, CSV, Excel or XML from the run, or have it sent to Google Sheets, Slack or a webhook.

Guide

How CVE Vulnerability Feed works

Inputs, options and tips, from the tool's own documentation.

New and updated vulnerabilities from NVD in one clean feed, each with CVSS score and severity, weakness types (CWE), affected vendors and products, references, whether it is known exploited (CISA KEV: date added, remediation due date, ransomware use) and its EPSS probability of exploitation. Filter to your stack and get only new CVEs every day. Or watch CISA's known-exploited catalog for new additions.

Built for security and IT teams, MSPs and MSSPs, vulnerability-management and GRC vendors, threat-intelligence analysts, and AI agents.

Why this Actor

Three sources joined: NVD, CISA KEV and EPSS in one row.
Filters: vendors, products, keywords, severity, minimum CVSS, known exploited only, minimum EPSS.
Alerts: Only new CVEs + a daily schedule, to Slack, email, Jira (via webhooks) or Google Sheets.
Two modes: everything new in NVD, or CVEs newly added to CISA's known-exploited list.
For AI agents. Callable as an MCP tool.

How to use it

Critical and high CVEs for your vendors, as a daily alert:

json

{ "withinDays": 2, "vendors": ["microsoft", "cisco", "fortinet"], "severities": ["CRITICAL", "HIGH"], "onlyNew": true }

Newly known-exploited vulnerabilities this week:

json

{ "source": "kev", "withinDays": 7 }

Pricing

$3 per 1,000 vulnerabilities plus a small start fee per run. On the Apify free plan a run returns up to 100 vulnerabilities.

Good to know

New CVEs often have no CVSS or EPSS score for a few days until NVD and FIRST analyse them.
For long date ranges, add your free NVD API key (optional) to read about 10× faster.
Questions: tacps126@gmail.com.

Questions

Questions about CVE Vulnerability Feed

How much does CVE Vulnerability Feed cost?

$3 per 1,000, charged only for vulnerabilitys returned; a run that finds nothing costs nothing. It runs on Apify, whose free plan includes monthly credit, so you can try it without paying.

Do I need to write code?

No. Fill in the form on Apify and press Start, schedule it, or send the results to Google Sheets, Slack or a webhook. For code, the input builder on this page writes the API call in curl, Python or JavaScript.

What does CVE Vulnerability Feed return?

Every row has the same fields, including cveId, url, published, lastModified, status, description, cvssScore, severity, cvss (vector, version, attack vector), cwe, vendors, products, cpes, knownExploited, kev (date added, due date, required action, ransomware use), epss, epssPercentile, publicExploitReference, references. Download as JSON, CSV, Excel or XML.

Can an AI agent use it?

Yes. The webdata-tools-mcp server exposes it to Claude, Cursor and other MCP clients as search_vulnerabilities.

Can it run on a schedule and return only new results?

Yes. Schedule it on Apify (hourly, daily, weekly) and turn on the only-new option: each run then returns only what appeared since the last run with the same input.

Pairs well

Pairs well with

Also in government

What people use CVE Vulnerability Feed for

Daily critical CVEs for the vendors you run
Patch triage by exploited status and EPSS
Security alerts into Slack or a ticket queue

Also searched as

CVE feed API NVD scraper CISA KEV feed vulnerability alerts EPSS scores