New WAF Objects: [total: 7]
==================================
Policy:
  name: 'CVE-2026-63219: GeoNetwork - Unauthenticated File Upload'
  id: '20000403'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request
    operation: Match All
    match values:
    - part: url
      operation: includes
      value: /srv/api/formatters
  - type: HTTP Request
    operation: Match Any
    match values:
    - part: parameter
      name: file
      operation: includes
      value: .xsl
    - part: parameter
      name: file
      operation: includes
      value: .zip
  - type: HTTP Request Method
    operation: At Least One
    values:
    - post

Signature:
    ID: '708599'
    Name: 'CVE-2026-81578: PaperCut Authentication Bypass'
    Attack: Authentication Bypass - Blocking
    Attack Class: Authentication Bypass
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="/app", part="service", rgxp="service=direct\/[^\/]+\/(Error|Exception|Home)\/(ConfigEditor|UserList)(\/|$)"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - url-and-parameters

Policy:
  name: 'CVE-2026-32475: WordPress Elementor Pro - File Upload'
  id: '20000395'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request Method
    operation: At Least One
    values:
    - POST
  - type: HTTP Request Parameter Name
    operation: At Least One
    values:
    - referer_title
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: form_fields[email]
      operation: includes
      value: .ph
    - part: url
      operation: includes
      value: /wp-admin/admin-ajax.php
    - part: parameter
      name: action
      operation: includes
      value: elementor_pro_forms_send_form
    - part: parameter
      name: filename
      operation: includes
      value: .ph

Signature:
    ID: '708598'
    Name: 'CVE-2026-18963: Keycloak - Account Takeover'
    Attack: Account Takeover - Blocking
    Attack Class: Account Takeover
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="login-actions/reset-credentials", part="tryAnotherWay"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - url-and-parameters

Policy:
  name: 'CVE-2026-22812: OpenCode - Unauthenticated RCE'
  id: '20000394'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request Method
    operation: At Least One
    values:
    - POST
  - type: HTTP Request Parameter Name
    operation: At Least One
    values:
    - command
  - type: HTTP Request
    operation: Match All
    match values:
    - part: header
      name: Content-Type
      operation: includes
      value: application/json
    - part: parameter
      name: agent
      operation: includes
      value: build
    - part: url
      operation: includes
      value: /session

Signature:
    ID: '708597'
    Name: 'CVE-2026-19912/CVE-2026-19913: Kaltura mwEmbed - Unsafe Deserialization and Path Traversal RCE'
    Attack: Remote Command Execution - Blocking
    Attack Class: Remote Command Execution
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="/mwEmbedLoader.php", rgxp="(?:ServiceUrl\=[\s\S]{0,10}(?:file:|http|ftp)|uiconf_id\=[\s\S]{0,10}(?:\.{1,}|\x5c{1,}|\x2f{1,}|%2f))"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - url-and-parameters

Policy:
  name: 'CVE-2026-23723: WeGIA - Authenticated SQL Injection'
  id: '20000393'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: metodo
      operation: includes
      value: listarTodosComAnexo
    - part: parameter
      name: nomeClasse
      operation: includes
      value: Atendido_ocorrenciaControle
    - part: url
      operation: includes
      value: /controle/control.php
  - type: HTTP Request Parameter Name
    operation: At Least One
    values:
    - id_memorando