{"items":[{"id":"CVE-2026-89036","published":"2026-09-17T15:54:46.106Z","updated":"2026-10-01T15:21:54.929Z","title":"Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter","severity":"HIGH","score":8.7,"vendor":"appwrite","product":"appwrite","kev":false,"epss":0.00702,"kevAdded":null},{"id":"CVE-2026-72861","published":"2026-08-20T19:48:51.102Z","updated":"2026-09-24T14:19:05.054Z","title":"Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent","severity":"MEDIUM","score":6.9,"vendor":"appwrite","product":"templates","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2024-1063","published":"2024-01-30T09:20:26.210Z","updated":"2025-05-29T15:05:40.384Z","title":"Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159.","severity":"MEDIUM","score":5.3,"vendor":"Appwrite","product":"Appwrite","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2022-2925","published":"2022-09-09T05:25:09.000Z","updated":"2024-08-03T00:52:59.827Z","title":"Cross-site Scripting (XSS) - Stored in appwrite/appwrite","severity":"CRITICAL","score":9,"vendor":"appwrite","product":"appwrite/appwrite","kev":false,"epss":0.00847,"kevAdded":null}]}