CVE & Package Vulnerability Lookup

What it does

Look up CVE details and open-source package vulnerabilities in one call. For each CVE id you get the NVD record (description, CWE, CVSS v4.0, v3.1 and v2 scores and vectors, references, affected products and CPEs), the EPSS exploit probability, CISA KEV status (date added, due date, ransomware use), CISA's SSVC decision points and a computed patch priority. For each package (npm:lodash@4.17.20, a purl, …) you get every known advisory from OSV for that version, merged across databases, with severity, CVSS, CWE, fixed versions, EPSS and KEV, plus the version to upgrade to. Built for security teams, vulnerability management and SBOM pipelines, and for coding agents checking a dependency before they add it.

Price per delivered record

Apify free plan: up to 10 items per run. Paid plans have no per-run cap; set maxTotalChargeUsd to cap spend.

Call it from code, an agent or the Console

This API is private on Apify for now. Email us and we will publish it for you, usually within two working days. The calls below work once it is public. contact@sfoln.com

curl -X POST "https://api.apify.com/v2/actors/sfoln~cve-lookup/run-sync-get-dataset-items" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"cveIds":["CVE-2021-44228"],"packages":["npm:lodash@4.17.20"]}'

{
  "mcpServers": {
    "apify": {
      "type": "http",
      "url": "https://mcp.apify.com?tools=sfoln/cve-lookup"
    }
  }
}

POST https://api.apify.com/v2/actors/sfoln~cve-lookup/runs?maxTotalChargeUsd=1
GET  https://api.apify.com/v2/actor-runs/{runId}            # until status is SUCCEEDED
GET  https://api.apify.com/v2/datasets/{defaultDatasetId}/items?format=json

Authenticate with an Apify API token. MCP clients can instead sign in with OAuth when prompted. Example prompt for an agent: Look up CVE-2021-44228 and check npm:lodash@4.17.20 for known vulnerabilities: give CVSS, EPSS, whether it is in CISA KEV, and the version to upgrade to.

Input fields

CVE ids and/or open-source packages. Each produces one dataset record with a normalized status.

{
  "cveIds": [
    "CVE-2021-44228"
  ],
  "packages": [
    "npm:lodash@4.17.20"
  ]
}

One record per input item

Records land in the run's dataset; a synchronous call returns them directly. Each has a status (ok is charged; everything else is free) and a charged flag. The run's OUTPUT record totals items and charges.

{
  "input": "CVE-2021-44228",
  "recordType": "cve",
  "cveId": "CVE-2021-44228",
  "found": true,
  "dataSource": "nvd",
  "vulnStatus": "Analyzed",
  "published": "2021-12-10T10:15:09.143Z",
  "lastModified": "2026-08-11T19:33:44.513Z",
  "description": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. …",
  "cwes": [
    "CWE-20",
    "CWE-400",
    "CWE-502",
    "CWE-917"
  ],
  "cvssScore": 10,
  "cvssSeverity": "CRITICAL",
  "cvssVersion": "3.1",
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "cvssV40Score": null,
  "cvssV40Severity": null,
  "cvssV40Vector": null,
  "cvssV31Score": 10,
  "cvssV31Severity": "CRITICAL",
  "cvssV31Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "cvssV2Score": 9.3,
  "cvssV2Severity": "HIGH",
  "cvssV2Vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
  "epssScore": 0.99999,
  "epssPercentile": 1,
  "epssDate": "2026-10-14",
  "kev": true,
  "kevDateAdded": "2021-12-10",
  "kevDueDate": "2021-12-24",
  "kevRansomwareUse": "Known",
  "kevRequiredAction": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. …",
  "kevVulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability",
  "ssvcExploitation": "active",
  "ssvcAutomatable": "yes",
  "ssvcTechnicalImpact": "total",
  "priority": "critical",
  "priorityReason": "listed in CISA Known Exploited Vulnerabilities",
  "affected": [
    {
      "vendor": "Apache Software Foundation",
      "product": "Apache Log4j2",
      "versions": [
        "2.0-beta9 to < log4j-core* (affected)"
      ]
    }
  ],
  "cpes": [
    "cpe:2.3:o:siemens:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:* <2.7.0"
  ],
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    }
  ],
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "status": "ok",
  "charged": true,
  "chargedEvent": "cve",
  "source": "nvd-osv",
  "fetchedAt": "2026-10-14T10:00:00.000Z"
}

Questions

Where does the data come from?

CVE details from the NVD CVE API 2.0 (falling back to the CVE.org record when NVD has not published or cannot be reached), exploit probability from FIRST EPSS, known exploitation from the CISA KEV catalogue, and package advisories from OSV (GitHub, PyPA, RustSec, Go and other databases), with deps.dev to tell an unknown package from a clean one.

How is the patch priority computed?

critical when the CVE is in CISA KEV or CISA's SSVC says exploitation is active; high when EPSS ≥ 0.1 or CVSS ≥ 9.0; medium when CVSS ≥ 7.0 or EPSS ≥ 0.01; otherwise low. The reason is in priorityReason.

Related APIs

• url-safety-check URL Safety Checker – Phishing & Malware$2 / 1,000
• domain-intelligence Domain WHOIS & DNS Lookup$3 / 1,000

This page for agents

• /actors/cve-lookup.json — this API as JSON
• /actors/cve-lookup.md — this API as Markdown
• /catalog.json — the whole catalogue