CVE-2026-100696

Published 26 September 2026 · tracked since 27 September 2026

Description

Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect() before the login result is validated, an unaut

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-126184 HIGH 8.2
• CVE-2026-126183 HIGH 8.7
• CVE-2026-126181 HIGH 8
• CVE-2026-126180 HIGH 8.4
• CVE-2026-126177 HIGH 8.1
• CVE-2026-126176 HIGH 8.1
• CVE-2026-126175 HIGH 8.8
• CVE-2026-126170 CRITICAL 9.8
• CVE-2026-126165 HIGH 7.5
• CVE-2026-126164 CRITICAL 9.4

→ Open the live CVE board · all tools