How to Scrape NVD CVE Vulnerability Data

NIST's official NVD CVE API 2.0 already exposes structured records, so browser scraping would add fragility without adding data. The NVD CVE Scraper handles pagination, retries, normalization, deduplication, and Apify dataset output.

Pick a bounded query

The Actor accepts product or vendor keywords, exact CVE IDs, CVSS severity, and CISA Known Exploited status. Start with one narrow query and a small result cap. Inspect the returned rows before increasing volume. A broad default is convenient for a demo, but it is a poor production specification.

{
  "keywordQueries": [
    "Apache"
  ],
  "severities": [
    "HIGH",
    "CRITICAL"
  ],
  "maxResultsPerSearch": 100
}

Each row contains description, published and modified timestamps, CVSS version, score, vector, severity, CWE IDs, recursively collected CPEs, references, and CISA KEV dates and actions. The natural key is cve_id. Use it when merging reruns; dataset row order is not an identity.

Export and verify

Run the Actor from the Apify Console, API, or a saved Task. JSON preserves arrays and nulls best. CSV is convenient for a quick spreadsheet review, but inspect how arrays were serialized before importing it into a warehouse.

Open several source links and compare identifiers, dates, and one multi-value field with the published record. CVSS is technical severity, not your business risk. Join results to an asset inventory and consider exposure, exploit status, ownership, and compensating controls before opening remediation tickets.

A good first run answers two questions: does the query find the intended population, and can every important row be traced back to the publisher? Scale only after both answers are yes.