SurfSense vulnerabilities

2 known vulnerabilities in SurfSense from MODSetter. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.3 High severity

  SurfSense: Improper Authentication

  CVE-2026-102245Sep 29, 2026MODSetter

  A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook_route.py of the component circleback Endpoint. Executing a manipulation can lead to missi

• 7.4 High severity

  SurfSense: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-102243Sep 29, 2026MODSetterEPSS 1.16%

  A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is pos