I'm building a WAF and I'm trying to gather most vulnerable exploits, based on your experience what are the protocols that are forgotten by web admins to catch...

Just block port 80. Complete protection.

@YourMom haha seems logic

What you're asking for is waf rulesets. Have a look at nginx modsecure's owasp ruleset. They have it all. Perhaps consider parsing their rules and reusing the already hefty knowledge base?

As for the most common ones -- do consult with owasp. Some llm might summarize it for you, like retoor said