CVE-2026-32294

JetKVM before 0.5.4 fails to verify downloaded firmware authenticity, enabling an attacker-in-the-middle or compromised update server to modify firmware and its SHA256 hash to pass verification. Impact is limited to local impact with high integrity risk, per CVSS 3.1/4.0 metrics: local access, hi...