CVE-2026-7666

score

<0.1

cvss

3.1

epss

0.2%

published

2026-06-03

kev added

—

first seen

2026-10-21

Django 6.0 < 6.0.6 and 5.2 < 5.2.15 contain an information disclosure vulnerability caused by reuse of a partially-initialized SMTP connection after failed STARTTLS handshake with fail_silently=True, letting on-path attackers read email content via cleartext interception, exploit requires network attacker position.