CVE-2022-27254

CVE-2022-27254 PoC for vulnerability in Honda's Remote Keyless SystemCVE-2022-27254 Disclaimer: For educational purposes only. Kindly note that the discoverers for this vulnerability are Ayyappan Rajesh, a student at UMass Dartmouth and HackingIntoYourHeart. Others mentioned in this repository ar...

cloudlist

기능 • 설치 • 사용법 • 설정 • Cloudlist 실행 • 지원되는 제공자 • 라이브러리 • 디스코드 참여 Cloudlist는 클라우드 제공자로부터 자산을 가져오기 위한 멀티 클라우드 도구입니다. 이 도구는 블루 팀이 매우 적은 설정 노력으로 여러 클라우드에 걸쳐 중앙 집중식 자산 목록을 유지 관리하여 공격 표면 관리 노력을 강화하기 위해 사용됩니다. 기능 여러 설정으로 클라우드 자산 나열 여러 클라우드 제공자 지원 키리스 인증 지원 AWS IRSA / 인스턴스 프로필, GCP 워크로드 아이덴티티 여러 출력 형식 지원 여...

cosign

cosign Sigstore を使用して OCI コンテナ（およびその他のアーティファクト）に署名します! Cosign は、署名を見えないインフラストラクチャ にすることを目指しています。 Cosign は以下をサポートしています: Sigstore のパブリックグッド Fulcio 認証局と Rekor 透過性ログを使用した「キーレス署名」（デフォルト） ハードウェアおよび KMS 署名 cosign が生成した暗号化された秘密鍵/公開鍵ペアによる署名 OCI レジストリでのコンテナの署名、検証、保存。 Bring-your-own PKI（独自 PKI の持ち込み） 情報...

CVE-2026-97898

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

EUVD-2026-86829

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-97898

The Akia keyless entry cloud service contained an Insecure Direct Object Reference (IDOR) vulnerability due to missing object-level authorization. The unlock action failed to validate client-supplied room or door identifiers against the authenticated guest's specific booking on the server-side. T...

CVE-2026-97898 Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2022-38766

CVE-2022-38766 Renault ZOE キーレスシステムの脆弱性 CVE-2022-38766 の PoC 紹介 Companylogo AUTOCRYPT MalHyuk 概要 本脆弱性は、ZOE 電気自動車が RF ハッキングに対して安全かどうかという疑問を提起しました。そのため、今年発売された実際の ZOE 車両を対象に攻撃を実施しました。また、この攻撃が RF ハッキングの防御手法であるローリングコードをどのように迂回するかについての研究も行い、車が故障した場合の対処方法についても多くの検討が必要でした。 攻撃シナリオ 現在でも多くの自動車は RF...

SecureML

SecureAIML 🔐 OpenSSF Model Signing に基づくエンタープライズ対応 AI モデルセキュリティ SecureAIMLは「モデルセキュリティのStripe」です。エンタープライズグレードのAIモデル保護を、あらゆる組織にとってアクセスしやすく、使いやすく、本番運用可能なものにします。 SecureAIMLが選ばれる理由 AI/MLの時代において、モデルセキュリティは極めて重要です。SecureAIMLは、強力な OpenSSF Model Signing 標準を、直感的でエンタープライズ対応のインターフェースで包み込み、MLモデルの保護を次のように簡単にします...

CVE-2026-0073-Android-adbd-authentication-bypass-POC

CVE-2026-0073に関する調査。ローカルネットワークアクセスを持つ任意の攻撃者が、開発者ツールとワイヤレスデバッグまたはADB-over-TCPが有効なAndroidデバイスに接続できるようにする認証バイパス。デバイスは事前にペアリングされている必要があります。 これはAndroid StudioのAndroid 14で動作確認済みです。他のバージョンでも動作するはずですが、悪用可能性は異なる場合があります。...

CVE-2025-70994

CVE-2025-70994: ヤデア T5 電動自転車における脆弱な認証 !WARNING このリポジトリは、教育および学術的なセキュリティ研究のみを目的として公開されています。ここで提供される情報と概念実証コードは、既知の暗号上の欠陥 CWE-1390 を実証し、車両の所有者とメーカーが物理的セキュリティを理解し改善することを支援するためのものです。 著者は、車両への不正アクセスや違法行為を容認、推奨、または支援するものではありません。概念実証コードは厳密にパッシブ信号アナライザ...

CVE-2026-49319

Remote Keyless Entry System RKES, using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication. An attacker within RF range who records two consecutive lock or unlock transmissions from a...

CVE-2026-49319 Alps Electric Co., Ltd. R53R0 Remote Keyless Entry System (RKES) Replay Attack

Remote Keyless Entry System RKES, using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication. An attacker within RF range who records two consecutive lock or unlock transmissions from a...

CVE-2026-49319 Alps Electric Co., Ltd. R53R0 Remote Keyless Entry System (RKES) Replay Attack

Remote Keyless Entry System RKES, using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication. An attacker within RF range who records two consecutive lock or unlock transmissions from a...

EUVD-2026-39417

Remote Keyless Entry System RKES, using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication. An attacker within RF range who records two consecutive lock or unlock transmissions from a...

CVE-2026-49319

CVE-2026-49319 concerns a roll-back attack on a Remote Keyless Entry System (RKES) using the 433 MHz key fob with FCC ID CWTR53R0 from ALPS ALPINE CO., LTD. The described vulnerability allows an attacker within RF range to record two consecutive lock/unlock transmissions and replay them to cause ...

PT-2026-52445

Name of the Vulnerable Software and Affected Versions Remote Keyless Entry System RKES using 433 MHz key fob FCC ID CWTR53R0 affected versions not specified Description The system is susceptible to a roll-back attack targeting its rolling-code authentication. An attacker within radio frequency...

CVE-2026-49319: Authentication Bypass by Capture-replay

Remote Keyless Entry System RKES, using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication. An attacker within RF range who records two consecutive lock or unlock transmissions from a...

CVE-2025-70994

Yadea T5 Electric Bicycles models manufactured in/after 2024 have a weak authentication mechanism in their keyless entry system. The system utilizes the EV1527 fixed-code RF protocol without implementing rolling codes or cryptographic challenge-response mechanisms. This is vulnerable to signal...

CVE-2026-44309

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying against the raw git...