MODSetter SurfSense

• CVE-2026-102245 High 7.3 MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication 0.4%
• CVE-2026-102244 Medium 4.3 MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery 0.2%
• CVE-2026-102243 High 7.4 MODSetter SurfSense MCP Connector Integration test command injection 1.2%