EUVD-2026-88618

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

EUVD-2026-88609

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

CVE-2026-102245

A vulnerability exists in MODSetter SurfSense versions up to 2.0.3 within the circleback Endpoint component. Specifically, an unknown function in the file surfsense_backend/app/routes/circleback_webhook_route.py lacks proper authentication, allowing for remote exploitation. Public exploits are av...

CVE-2026-102244 MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2026-102244

MODSetter SurfSense versions up to 0.0.36 are vulnerable to a server-side request forgery (SSRF) flaw within the Document Export Feature . The vulnerability exists in an unspecified function located in surfsense_backend/app/routes/editor_routes.py. This flaw allows for remote manipulation that ca...

CVE-2026-102243

A command injection vulnerability exists in MODSetter SurfSense up to version 2.0.3 . The flaw resides in the MCP Connector Integration component, specifically involving unknown processing of the /api/search-source/connectors/mcp/test file. This vulnerability allows for remote attacks. While the ...