InfoSecBulletin Cybersecurity for mankind

The WordPress security team received reports about these flaws: CVE-2026-60137 : A facilitated SQL injection issue reported as a team by TF1T, dtro, and haongo CVE-2026-63030 : A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution reported by Adam Kues at Assetnote / Searchlight Cyber …

A Windows security flaw called LegacyHive (MSNightmare) misuses the User Profile Service. This allows local users to gain higher privileges, change admin accounts, and run code with admin rights. The public proof‑of‑concept (PoC) from the MSNightmare GitHub account describes the bug as a “Windows user profile service arbitrary hive load …

Zoom has issued updates for a flaw in the Windows desktop client, known as CVE-2026-53412. This issue may allow an unauthenticated user to conduct an account takeover via network access. This flaw arises from improper input validation and may enable unauthenticated attackers to execute account takeover attacks via network access. …