CVE updates

README.md

@@ -247,6 +247,7 @@ KAT matches capture metadata (Year / Make / Model / Region, set via **i** on a c
 |-----|---------|--------|------------|-------------|
 | [CVE-2022-38766](https://nvd.nist.gov/vuln/detail/CVE-2022-38766) | Renault | ZOE | 2020–2022 | Replay attack: same rolling code set per door-open request (433.92 MHz). |
 | [CVE-2022-27254](https://nvd.nist.gov/vuln/detail/CVE-2022-27254) | Honda | Civic | 2016–2019 | Replay attack: same RF signal per door-open request (related to CVE-2019-20626). |
+| [CVE-2019-20626](https://nvd.nist.gov/vuln/detail/CVE-2019-20626) | Honda, Acura | HR-V, Civic, Accord; TSX | 2009, 2016–2020 (by model) | Replay attack: same RF signal per door-open request (static code, no rolling code). Confirmed vehicles per [Unoriginal-Rice-Patty](https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty). |
 | [CVE-2022-37418](https://nvd.nist.gov/vuln/detail/CVE-2022-37418) | Honda, Hyundai, Kia, Nissan | Fit (hybrid), Fit, City, Vezel; Elantra; Cerato, Forte, K3; Latio, Sylphy | 2007–2022 (varies by model) | **RollBack attack:** RKE allows unlock and resync after capturing two consecutive key fob signals; attacker can unlock indefinitely. |
 | [CVE-2022-36945](https://nvd.nist.gov/vuln/detail/CVE-2022-36945) | Mazda | 3, 2 Sedan, 2 HB (facelift), Cx-3, Cx-5 | 2018–2020 (varies by model) | **RollBack attack:** RKE allows unlock and resync after capturing **three** consecutive key fob signals; attacker can unlock indefinitely. |
 

src/vuln_db.rs

@@ -26,7 +26,7 @@ pub struct VulnEntry {
     pub url: &'static str,
 }
 
-pub const VULN_DB: [VulnEntry; 16] = [
+pub const VULN_DB: [VulnEntry; 21] = [
     VulnEntry {
         id: 1,
         cve: "CVE-2022-38766",
@@ -209,6 +209,62 @@ pub const VULN_DB: [VulnEntry; 16] = [
         description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
     },
+    // CVE-2019-20626: Honda/Acura static code replay (no rolling code). Confirmed vehicles per Unoriginal-Rice-Patty.
+    VulnEntry {
+        id: 17,
+        cve: "CVE-2019-20626",
+        year_start: "2009",
+        year_end: "2009",
+        makes: &["Acura"],
+        models: &["TSX"],
+        region: "ALL",
+        description: "The remote keyless system sends the same RF signal for each door-open request, which might allow a replay attack. Honda/Acura use static codes (no rolling code).",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2019-20626",
+    },
+    VulnEntry {
+        id: 18,
+        cve: "CVE-2019-20626",
+        year_start: "2016",
+        year_end: "2016",
+        makes: &["Honda"],
+        models: &["Accord"],
+        region: "ALL",
+        description: "The remote keyless system sends the same RF signal for each door-open request, which might allow a replay attack. Honda/Acura use static codes (no rolling code).",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2019-20626",
+    },
+    VulnEntry {
+        id: 19,
+        cve: "CVE-2019-20626",
+        year_start: "2017",
+        year_end: "2017",
+        makes: &["Honda"],
+        models: &["HR-V"],
+        region: "ALL",
+        description: "The remote keyless system on Honda HR-V 2017 vehicles sends the same RF signal for each door-open request, which might allow a replay attack.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2019-20626",
+    },
+    VulnEntry {
+        id: 20,
+        cve: "CVE-2019-20626",
+        year_start: "2018",
+        year_end: "2018",
+        makes: &["Honda"],
+        models: &["Civic"],
+        region: "ALL",
+        description: "The remote keyless system sends the same RF signal for each door-open request, which might allow a replay attack. Honda/Acura use static codes (no rolling code).",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2019-20626",
+    },
+    VulnEntry {
+        id: 21,
+        cve: "CVE-2019-20626",
+        year_start: "2020",
+        year_end: "2020",
+        makes: &["Honda"],
+        models: &["Civic"],
+        region: "ALL",
+        description: "The remote keyless system sends the same RF signal for each door-open request, which might allow a replay attack. Honda/Acura use static codes (no rolling code).",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2019-20626",
+    },
 ];
 
 /// Match a capture's year/make/model/region against the DB.