CVE-2026-7666

LowCVSS 3.1/10Last modified Jul 21, 2026

Description

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to read email content via cleartext interception. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kasper Dupont for reporting this issue.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published
Jun 3, 2026
Last modified
Jul 21, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-766608.7A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.CVE-2026-766617.6A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.CVE-2026-766625.9A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.CVE-2026-766637.5A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.CVE-2026-766646.4A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operationsCVE-2026-766657.1A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.CVE-2026-766664.7A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.CVE-2026-766675.7A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.CVE-2026-766686.3A security vulnerability in HPE NonStop Kernel may allow user space access to privileged or unmapped data.CVE-2026-766699.9Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allowCVE-2026-76678.8IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL thaCVE-2026-766709.9Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow
CVE-2026-7666: Low severity, CVSS 3.1 | Vulnix