IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
3.1Düşük

CVE-2026-7666Potential unencrypted email transmission via STARTTLS in the SMTP backend

djangoproject Django Yayım: (5 ay önce)

Açıklama

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to read email content via cleartext interception. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kasper Dupont for reporting this issue.

Zayıflık türü (CWE): CWE-319

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
djangoproject Django 6.0 – < 6.0.6, fixed 6.0.6, 5.2 – < 5.2.15, fixed 5.2.15

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (2)
  • cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* ≥ 5.2 < 5.2.15
  • cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* ≥ 6.0 < 6.0.6

Aynı üründe son açıklar — Django

5.3Orta
CVE-2026-114582

Server-side request forgery via SpatialReference string input

djangoproject Django

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.SpatialReference` (and related `transform()` methods and `srs`/`srid` setters) do not restrict GDAL’s file and network access when parsing s…

5.3Orta
CVE-2026-111211

Potential log injection via unescaped geometry form values

djangoproject Django

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values befor…