New WAF Objects: [total: 12]
==================================
Policy:
  name: |-
    CVE-2026-78006: WP plugin The Events Calendar - Unauthenticated PHP Object Injection to Remote Code Execution
  id: '20000410'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: comment_post_ID
      operation: MatchRegExp
      value: .
    - part: parameter
      name: comment
      operation: includes
      value: wp:legacy-widget
    - part: url
      operation: includes
      value: /wp-comments-post.php
  - type: HTTP Request Method
    operation: At Least One
    values:
    - POST

Policy:
  name: 'CVE-2026-72708: SPIP CMS - SQL Injection via annee parameter'
  id: '20000409'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request Method
    operation: At Least One
    values:
    - POST
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: annee
      operation: MatchRegExp
      value: ^\w+\(
    - part: parameter
      name: page
      operation: includes
      value: sitemap.xml
    - part: url
      operation: includes
      value: /spip.php

Policy:
  name: 'CVE-2026-89026: Issabel Framework pbxapi - Unauthenticated JWT Forge RCE'
  id: '20000408'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: data
      operation: MatchRegExp
      value: .
    - part: url
      operation: includes
      value: /pbxapi/manager/originate
    - part: parameter
      name: application
      operation: includes
      value: system
    - part: header
      name: Authorization
      operation: includes
      value: Bearer

Signature:
    ID: '708604'
    Name: 'CVE-2026-82329: JFrog Artifactory - Authentication Bypass'
    Attack: Authentication Bypass - Blocking
    Attack Class: Authentication Bypass
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="/access/api/v1/registry/join", rgxp="(iLCJza2lwX25vZGVfcmVnaXN0cmF0aW9uIjp0cnVlf|Iiwic2tpcF9ub2RlX3JlZ2lzdHJhdGlvbiI6dHJ1ZX|SIsInNraXBfbm9kZV9yZWdpc3RyYXRpb24iOnRydWV)"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - url-and-parameters

Policy:
  name: 'CVE-2026-0768: Langflow - Remote Code Execution via Code Injection'
  id: '20000407'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request Method
    operation: At Least One
    values:
    - post
  - type: HTTP Request
    operation: Match All
    match values:
    - part: url
      operation: MatchRegExp
      value: \/api\/v1\/validate(\/|$)
  - type: HTTP Request Parameter Name
    operation: At Least One
    values:
    - code
  - type: HTTP Request
    operation: Match All
    match values:
    - part: url
      operation: includes
      value: /api/v1/validate

Signature:
    ID: '708603'
    Name: OR LIKE SQLi
    Attack: SQL Injection - Blocking
    Attack Class: SQL Injection
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="OR ", part="LIKE", rgxp="[\x27`][\s)]{0,8}\b(?:AND|OR)\b[\s\S]{0,50}\bLIKE\b\s*(?:0x[0-9A-Fa-f]+|\d+\s*(?:--|#|\x{2013}|\x{2014}))"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - parameters
    - headers

Signature:
    ID: '708602'
    Name: 'AND LIKE SQLi'
    Attack: SQL Injection - Blocking
    Attack Class: SQL Injection
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="AND", part="LIKE", rgxp="[\x27`][\s)]{0,8}\b(?:AND|OR)\b[\s\S]{0,50}\bLIKE\b\s*(?:0x[0-9A-Fa-f]+|\d+\s*(?:--|#|\x{2013}|\x{2014}))"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - parameters
    - headers

Policy:
  name: 'CVE-2026-85706: GitLab - Path Traversal'
  id: '20000406'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request
    operation: Match All
    match values:
    - part: url
      operation: includes
      value: /repository/commits/
    - part: url
      operation: includes
      value: /api/v4/projects/
  - type: HTTP Request Parameter Name
    operation: At Least One
    values:
    - file.path
  - type: HTTP Request Method
    operation: At Least One
    values:
    - POST

Policy:
  name: 'CVE-2026-19949: All-in-One WP Migration and Backup - SQLi to RCE'
  id: '20000405'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: blog_name
      operation: MatchRegExp
      value: /\x5c$
    - part: parameter
      name: url
      operation: MatchRegExp
      value: .
  - type: HTTP Request Method
    operation: At Least One
    values:
    - POST
  - type: HTTP Request
    operation: Match Any
    match values:
    - part: url
      operation: includes
      value: /wp-trackback.php
    - part: url
      operation: includes
      value: /trackback

Signature:
    ID: '708601'
    Name: 'CVE-2026-75650: Magento and Adobe Commerce - StyleSmuggler Unauthenticated
    RCE (2)'
    Attack: Remote Command Execution - Blocking
    Attack Class: Remote Command Execution
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="{{block", rgxp="(^|&)[^=]{0,50}(generatorClass|with_resolved)[^=]{0,50}="
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - url-and-parameters

Signature:
    ID: '708600'
    Name: 'CVE-2026-75650: Magento and Adobe Commerce - StyleSmuggler Unauthenticated
    RCE'
    Attack: Remote Command Execution - Blocking
    Attack Class: Remote Command Execution
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="/graphql", part="styles[", rgxp="(^|&)styles\[[^=]{0,50}="
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - url-and-parameters

Policy:
  name: 'CVE-2026-19490: Citrix NetScaler ADC/Gateway - Authentication Bypass'
  id: '20000404'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request Parameter Name
    operation: Exclude All
    values:
    - Signature
    - SigAlg
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: SAMLResponse
      operation: MatchRegExp
      value: .
    - part: url
      operation: includes
      value: /cgi/samlauth