{"name":"cve-lookup","id":"sfoln/cve-lookup","title":"CVE & Package Vulnerability Lookup","description":"CVE details from NVD: CVSS v3.1 and v4.0 scores and vectors, CWE, references, EPSS exploit probability and CISA KEV status with a patch priority. Also scans open-source packages (npm, PyPI, Maven, Go, crates.io, NuGet, RubyGems) via OSV with fixed versions. $2 per 1,000 lookups.","version":"0.1","status":"ready","family":{"id":"compliance-public-records","name":"Compliance & public records","description":"Sanctions screening, KYB company checks, LEI and VAT validation, SEC EDGAR filings, Form D offerings, insider trades and CVE records.","actors":8},"categories":["DEVELOPER_TOOLS","AI","AUTOMATION"],"availability":"on_request","seoTitle":"CVE Lookup API – CVSS, EPSS, CISA KEV & Package Scan","seoDescription":"CVE lookup API: NVD details with CVSS v3.1/v4.0, CWE, EPSS and CISA KEV, plus npm, PyPI, Maven, Go and Cargo package scans with fixed versions.","summary":"Look up CVE details and open-source package vulnerabilities in one call. For each CVE id you get the NVD record (description, CWE, CVSS v4.0, v3.1 and v2 scores and vectors, references, affected products and CPEs), the EPSS exploit probability, CISA KEV status (date added, due date, ransomware use), CISA's SSVC decision points and a computed patch priority. For each package (npm:lodash@4.17.20, a purl, …) you get every known advisory from OSV for that version, merged across databases, with severity, CVSS, CWE, fixed versions, EPSS and KEV, plus the version to upgrade to. Built for security teams, vulnerability management and SBOM pipelines, and for coding agents checking a dependency before they add it.","pricing":{"model":"pay-per-event","currency":"USD","billedBy":"Apify","freePlanMaxItemsPerRun":10,"events":[{"name":"cve","title":"CVE record","description":"One CVE with NVD details (CVSS, CWE, references), EPSS score, CISA KEV status and patch priority.","priceUsd":0.002},{"name":"package","title":"Package vulnerability report","description":"One open-source package version checked against OSV: advisories with severity, CVSS, fixed versions, EPSS and KEV, and the version to upgrade to.","priceUsd":0.002}]},"input":{"description":"CVE ids and/or open-source packages. Each produces one dataset record with a normalized status.","required":[],"fields":[{"name":"cveIds","title":"CVE ids","type":"array","required":false,"description":"CVE identifiers, one per line (CVE-2021-44228). Each returns NVD details (CVSS, CWE, references), the EPSS score and CISA KEV status. Accounts on the Apify free plan can process up to 10 CVEs and packages per run.","prefill":["CVE-2021-44228"],"editor":"stringList"},{"name":"packages","title":"Packages","type":"array","required":false,"description":"Open-source packages, one per line, as ecosystem:name@version (npm:lodash@4.17.20, pypi:requests==2.19.0, maven:org.apache.logging.log4j:log4j-core@2.14.1, go:golang.org/x/net@v0.17.0, cargo:serde@1.0.0, nuget:Newtonsoft.Json@12.0.1, gem:rails@6.1.0, composer:symfony/http-kernel@5.4.0) or a purl (pkg:npm/lodash@4.17.20). Without a version, every known advisory of the package is listed.","prefill":["npm:lodash@4.17.20"],"editor":"stringList"},{"name":"maxItems","title":"Max items","type":"integer","required":false,"description":"Safety cap on CVEs plus packages processed in this run; the rest are ignored and counted as inputItemsDropped in the OUTPUT record.","default":1000,"minimum":1,"maximum":10000},{"name":"concurrency","title":"Concurrency","type":"integer","required":false,"description":"Items processed in parallel (NVD's own limit of 5 requests per 30 s applies to CVE lookups whatever this value).","default":4,"minimum":1,"maximum":8},{"name":"includeRaw","title":"Include raw upstream data","type":"boolean","required":false,"description":"Attach the NVD / CVE.org record, EPSS and KEV entries (CVEs) or the OSV advisories (packages).","default":false}]},"exampleInput":{"cveIds":["CVE-2021-44228"],"packages":["npm:lodash@4.17.20"]},"outputFields":[{"name":"input","type":"string | object","title":"Input","description":"The CVE id or package spec as entered (CVE ids upper-cased)."},{"name":"recordType","type":"string","title":"Record type","description":"cve | package.","example":"cve"},{"name":"cveId","type":"string","title":"CVE","example":"CVE-2021-44228"},{"name":"found","type":"boolean","title":"Found"},{"name":"dataSource","type":"string","title":"Data source","description":"nvd, or cve.org when NVD has no record yet or could not be reached."},{"name":"vulnStatus","type":"string | null","title":"Status at source","description":"NVD: Analyzed, Awaiting Analysis, Modified, Deferred, Rejected, …; CVE.org: PUBLISHED, REJECTED."},{"name":"published","type":"string | null","title":"Published"},{"name":"lastModified","type":"string | null","title":"Last modified"},{"name":"description","type":"string | null","title":"Description"},{"name":"cwes","type":"array","title":"CWEs","example":["CWE-502"]},{"name":"cvssScore","type":"number | null","title":"CVSS score","description":"Headline score: CVSS v3.1, else v3.0, else v4.0, else v2."},{"name":"cvssSeverity","type":"string | null","title":"Severity"},{"name":"cvssVersion","type":"string | null","title":"CVSS version"},{"name":"cvssVector","type":"string | null","title":"CVSS vector"},{"name":"cvssV40Score","type":"number | null","title":"CVSS 4.0 score"},{"name":"cvssV40Severity","type":"string | null","title":"CVSS 4.0 severity"},{"name":"cvssV40Vector","type":"string | null","title":"CVSS 4.0 vector"},{"name":"cvssV31Score","type":"number | null","title":"CVSS 3.x score"},{"name":"cvssV31Severity","type":"string | null","title":"CVSS 3.x severity"},{"name":"cvssV31Vector","type":"string | null","title":"CVSS 3.x vector"},{"name":"cvssV2Score","type":"number | null","title":"CVSS 2 score"},{"name":"cvssV2Severity","type":"string | null","title":"CVSS 2 severity"},{"name":"cvssV2Vector","type":"string | null","title":"CVSS 2 vector"},{"name":"epssScore","type":"number | null","title":"EPSS","description":"FIRST EPSS: probability of exploitation activity in the next 30 days (0–1)."},{"name":"epssPercentile","type":"number | null","title":"EPSS percentile"},{"name":"epssDate","type":"string | null","title":"EPSS date"},{"name":"kev","type":"boolean | null","title":"In CISA KEV","description":"Listed in CISA's Known Exploited Vulnerabilities catalogue (null when the catalogue could not be read)."},{"name":"kevDateAdded","type":"string | null","title":"KEV added"},{"name":"kevDueDate","type":"string | null","title":"KEV due date"},{"name":"kevRansomwareUse","type":"string | null","title":"Ransomware use","description":"Known | Unknown."},{"name":"kevRequiredAction","type":"string | null","title":"KEV required action"},{"name":"kevVulnerabilityName","type":"string | null","title":"KEV name"},{"name":"ssvcExploitation","type":"string | null","title":"SSVC exploitation","description":"CISA SSVC: none | poc | active."},{"name":"ssvcAutomatable","type":"string | null","title":"SSVC automatable"},{"name":"ssvcTechnicalImpact","type":"string | null","title":"SSVC technical impact"},{"name":"priority","type":"string","title":"Patch priority","description":"critical | high | medium | low (see priorityReason)."},{"name":"priorityReason","type":"string","title":"Priority reason"},{"name":"affected","type":"array","title":"Affected products","description":"[{ vendor, product, versions[] }] as stated by the CVE's assigner (at most 25)."},{"name":"cpes","type":"array","title":"Vulnerable CPEs","description":"NVD's vulnerable CPE match criteria with version bounds (at most 100)."},{"name":"references","type":"array","title":"References","description":"[{ url, tags[] }] (at most 50)."},{"name":"nvdUrl","type":"string","title":"NVD page"},{"name":"package","type":"string","title":"Package","description":"Canonical ecosystem:name@version.","example":"npm:lodash@4.17.20"},{"name":"ecosystem","type":"string","title":"Ecosystem"},{"name":"name","type":"string","title":"Name"},{"name":"version","type":"string | null","title":"Version"},{"name":"vulnerable","type":"boolean","title":"Vulnerable"},{"name":"vulnCount","type":"integer","title":"Vulnerabilities","description":"Distinct vulnerabilities (advisories of several databases for one CVE count once)."},{"name":"maxSeverity","type":"string | null","title":"Max severity"},{"name":"maxCvssScore","type":"number | null","title":"Max CVSS"},{"name":"knownExploited","type":"boolean | null","title":"Known exploited","description":"Any of its CVEs is in CISA KEV."},{"name":"maxEpss","type":"number | null","title":"Max EPSS"},{"name":"upgradeTo","type":"string | null","title":"Upgrade to","description":"Lowest version that fixes every fixable advisory of the queried version (best-effort version ordering)."},{"name":"unfixedCount","type":"integer | null","title":"Without a fix"},{"name":"advisories","type":"array","title":"Advisories","description":"[{ id, aliases, cveIds, databases, summary, severity, cvssScore, cvssVersion, cvssVector, cwes, fixedIn, fixedVersions, published, modified, epss, epssPercentile, kev, kevDateAdded, kevDueDate, kevRansomwareUse, url, references }]"},{"name":"osvUrl","type":"string","title":"OSV page"},{"name":"status","type":"string","title":"Status","description":"ok | not_found | error | skipped_invalid | skipped_budget | skipped_free_plan | skipped_unmetered","example":"ok"},{"name":"charged","type":"boolean","title":"Charged"},{"name":"chargedEvent","type":"string","title":"Charged event"},{"name":"chargedCount","type":"integer","title":"Events charged"},{"name":"source","type":"string","title":"Source","description":"nvd-osv"},{"name":"fetchedAt","type":"string","title":"Fetched at"},{"name":"error","type":"object","title":"Error","description":"{ code, message, provider?, status? } when status is not ok. Codes: invalid_package, not_found, rate_limit, timeout, network, server, client, invalid_response; runtime: budget_exhausted, free_plan_limit, unmetered, aborted, charge_failed, record_too_large, invalid_record, dataset_push_failed."},{"name":"warnings","type":"array","title":"Warnings"},{"name":"raw","type":"object","title":"Raw","description":"Upstream records (only with includeRaw)."}],"outputExample":{"input":"CVE-2021-44228","recordType":"cve","cveId":"CVE-2021-44228","found":true,"dataSource":"nvd","vulnStatus":"Analyzed","published":"2021-12-10T10:15:09.143Z","lastModified":"2026-08-11T19:33:44.513Z","description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. …","cwes":["CWE-20","CWE-400","CWE-502","CWE-917"],"cvssScore":10,"cvssSeverity":"CRITICAL","cvssVersion":"3.1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssV40Score":null,"cvssV40Severity":null,"cvssV40Vector":null,"cvssV31Score":10,"cvssV31Severity":"CRITICAL","cvssV31Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssV2Score":9.3,"cvssV2Severity":"HIGH","cvssV2Vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","epssScore":0.99999,"epssPercentile":1,"epssDate":"2026-10-14","kev":true,"kevDateAdded":"2021-12-10","kevDueDate":"2021-12-24","kevRansomwareUse":"Known","kevRequiredAction":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. …","kevVulnerabilityName":"Apache Log4j2 Remote Code Execution Vulnerability","ssvcExploitation":"active","ssvcAutomatable":"yes","ssvcTechnicalImpact":"total","priority":"critical","priorityReason":"listed in CISA Known Exploited Vulnerabilities","affected":[{"vendor":"Apache Software Foundation","product":"Apache Log4j2","versions":["2.0-beta9 to < log4j-core* (affected)"]}],"cpes":["cpe:2.3:o:siemens:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:* <2.7.0"],"references":[{"url":"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]}],"nvdUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","status":"ok","charged":true,"chargedEvent":"cve","source":"nvd-osv","fetchedAt":"2026-10-14T10:00:00.000Z"},"faq":[{"question":"Where does the data come from?","answer":"CVE details from the NVD CVE API 2.0 (falling back to the CVE.org record when NVD has not published or cannot be reached), exploit probability from FIRST EPSS, known exploitation from the CISA KEV catalogue, and package advisories from OSV (GitHub, PyPA, RustSec, Go and other databases), with deps.dev to tell an unknown package from a clean one."},{"question":"How is the patch priority computed?","answer":"critical when the CVE is in CISA KEV or CISA's SSVC says exploitation is active; high when EPSS ≥ 0.1 or CVSS ≥ 9.0; medium when CVSS ≥ 7.0 or EPSS ≥ 0.01; otherwise low. The reason is in priorityReason."}],"mcpExamplePrompt":"Look up CVE-2021-44228 and check npm:lodash@4.17.20 for known vulnerabilities: give CVSS, EPSS, whether it is in CISA KEV, and the version to upgrade to.","related":["url-safety-check","domain-intelligence"],"urls":{"site":"https://www.sfoln.com/actors/cve-lookup/","siteJson":"https://www.sfoln.com/actors/cve-lookup.json","siteMarkdown":"https://www.sfoln.com/actors/cve-lookup.md","runSync":"https://api.apify.com/v2/actors/sfoln~cve-lookup/run-sync-get-dataset-items","runAsync":"https://api.apify.com/v2/actors/sfoln~cve-lookup/runs","mcp":"https://mcp.apify.com?tools=sfoln/cve-lookup","requestAccess":"mailto:contact@sfoln.com?subject=Access%20request%3A%20CVE%20%26%20Package%20Vulnerability%20Lookup%20(sfoln%2Fcve-lookup)&body=Please%20publish%20cve-lookup.%20What%20we%20plan%20to%20use%20it%20for%3A"},"publisher":{"name":"SFOLN LLC","apifyUsername":"sfoln","url":"https://www.sfoln.com","apifyProfile":"https://apify.com/sfoln","email":"contact@sfoln.com"},"generatedAt":"2026-10-22T04:28:58.477Z"}