Dependency Vulnerability Advisor — Exploited-First Triage
Scan dependencies against the OSV database and get the exact version to upgrade to. Cross-references CISA KEV and EPSS so you see which findings are actually being exploited in the wild, not just which have a scary CVSS score. Turns a list of CVEs into a ranked fix list.
Dependency Vulnerability Advisor — Exploited-First Triage returns 32 documented output fields, including package, ecosystem, currentVersion, vulnerabilityId and cve. Every field carries a declared type, a written description and an example value. 30 runs are recorded on Apify.
Run it on ApifyPay per result · no subscription
- 32
- Output fields
- 7
- Inputs
- 30
- Runs
- 2026-10-15
- Last run
01 — output
What it returns
Every field the extractor writes to its dataset, with its type, a written description and an example value.
| Field | Type | What it holds | Example |
|---|---|---|---|
| package | stringnull | Package name. | lodash |
| ecosystem | stringnull | Package ecosystem, for example npm, PyPI or Maven. | <ecosystem> |
| currentVersion | stringnull | Version currently in use. | 4.17.21 |
| vulnerabilityId | stringnull | Identifier of this vulnerability. | <vulnerabilityId> |
| cve | stringnull | CVE identifier for this vulnerability. | <cve> |
| severity | stringnull | Severity as classified by the source. | moderate |
| severityRank | integernull | Numeric severity, for sorting. Higher is more severe. | 0 |
| summary | stringnull | Short human-readable summary of this row. | Price changed: $9 → $12 |
| fixedVersion | stringnull | Nearest version that contains the fix. | <fixedVersion> |
| fixAvailable | booleannull | Whether a fixed version exists. | true |
| upgradeTarget | stringnull | Version the upgrade would move to. | <upgradeTarget> |
| packageVulnerabilityCount | integernull | Package Vulnerability Count as recorded for this row. | 0 |
| recommendation | stringnull | The recommended action for this row. | Review the price change before it propagates. |
| cwe | stringnull | CWE identifier describing the weakness class. | <cwe> |
| published | stringnull | Date the advisory or version was published. | <published> |
| advisoryUrl | stringnull | Link to the advisory at its source. | <advisoryUrl> |
| dependencyType | stringnull | Whether the dependency is direct or transitive. | <dependencyType> |
| status | stringnull | Outcome recorded for this row. | ok |
| packagesChecked | integernull | How many packages were checked. | 0 |
| checkedAt | stringnull | ISO 8601 timestamp of the most recent check. | 2026-10-16T09:12:44.000Z |
| allFixedVersions | stringnull | Every version known to contain the fix. | <allFixedVersions> |
| safeTarget | stringnull | A recognised safe CNAME target. | <safeTarget> |
| clearedBySafeTarget | integernull | Whether a recognised safe target cleared this subdomain. | 0 |
| needsMajorUpgrade | booleannull | Whether moving to the latest requires a breaking-change upgrade. | true |
| knownExploited | booleannull | Whether the vulnerability appears in a known-exploited list. | true |
| kevRansomware | booleannull | Whether the vulnerability is used in known ransomware campaigns. | true |
| kevDueDate | stringnull | Remediation deadline set for this known-exploited vulnerability. | <kevDueDate> |
| epssScore | numbernull | Exploit Prediction Scoring System probability, from 0 to 1. | 0 |
| epssPercentile | numbernull | EPSS percentile, from 0 to 1. | 0 |
| priority | stringnull | Priority assigned to this row. | high |
| priorityRank | integernull | Priority expressed as an orderable rank. Lower is more urgent. | 0 |
| why | stringnull | Why the Actor reached this conclusion. | <why> |
02 — sample
One record
Assembled from the example values declared on the schema above, not invented at render time.
{
"package": "lodash",
"ecosystem": "<ecosystem>",
"currentVersion": "4.17.21",
"vulnerabilityId": "<vulnerabilityId>",
"cve": "<cve>",
"severity": "moderate",
"severityRank": 0,
"summary": "Price changed: $9 → $12"
}03 — input
What you give it
| Input | Type | Description |
|---|---|---|
| packages | arrayoptional | Explicit packages as ecosystem:name@version, e.g. npm:lodash@4.17.15 or pypi:django@3.2.1. Scoped npm names work: npm:@babel/core@7.0.0. |
| manifestUrls | arrayoptional | Public URLs to a package.json, package-lock.json or requirements.txt — raw.githubusercontent.com links work well. A lockfile is best: it lists what you actually run, not a range. |
| defaultEcosystem | stringoptional | Used when a package is given without an ecosystem prefix. |
| minSeverity | stringoptional | Only return findings at or above this level. |
| concurrency | integeroptional | How many packages to query at once. |
| maxItems | integeroptional | Hard cap on findings returned. You are never charged beyond this. |
| checkExploitation | booleanoptional | Cross-reference every finding against CISA KEV (confirmed exploited in the wild) and EPSS (probability of exploitation in the next 30 days). This is what turns a list of findings into triage — a MODERATE CVE being actively exploited matters more than a CRITICAL one nobody is using. |
04 — run
Run Dependency Vulnerability Advisor on your own input
It runs in the cloud on Apify. Nothing to install, and you are billed per result returned rather than per attempt.
05 — questions
Asked before running it
32 of 32 fields described
- What does Dependency Vulnerability Advisor — Exploited-First Triage return?
- It returns 32 documented output fields: package, ecosystem, currentVersion, vulnerabilityId, cve, severity, severityRank, summary, fixedVersion, fixAvailable, upgradeTarget and packageVulnerabilityCount. Each field declares its type, a description of what it holds, and an example value. The remaining 20 are listed in the output schema below.
- What input does Dependency Vulnerability Advisor — Exploited-First Triage take?
- All 7 inputs are optional and ship with usable defaults, so it runs as-is. They are listed with their types below.
- Does Dependency Vulnerability Advisor — Exploited-First Triage need an API key or login?
- No. None of its inputs is a credential, and it reads only public data. Nothing to sign up for before the first run.
- How do I run Dependency Vulnerability Advisor — Exploited-First Triage?
- It runs on Apify. Start it from its listing with the inputs above, or call the Apify API with the Actor's ID. Results land in a dataset you can export as JSON, CSV or Excel, or read through the Apify API into your own pipeline.