CyberSecBulletin

MODSetter vulnerabilities

We track 2 vulnerabilities in MODSetter products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 29, 2026.

2vulnerabilities
0critical
2high
0exploited
7.3average CVSS score

Latest MODSetter vulnerabilities

  • 7.3 High severity

    SurfSense: Improper Authentication

    CVE-2026-102245MODSetter

    A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook_route.py of the component circleback Endpoint. Executing a manipulation can lead to missi

  • 7.4 High severity

    SurfSense: Improper Neutralization of Special Elements in Output Used by a Downstream Component

    CVE-2026-102243MODSetterEPSS 1.16%

    A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is pos