Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)

Fix availableCritical · CVSS 9.6

Published Jun 19, 2026 · updated Sep 24, 2026

What to do

  1. Upgrade to a fixed version: io.openremote:openremote-manager 1.25.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenio.openremote:openremote-manager

Vulnerable versions
< 1.25.0
Fixed in
1.25.0

Check your project: mvn dependency:tree -Dincludes=io.openremote:openremote-manager

Sources

CWE-639 Authorization Bypass Through User-Controlled Key

← All critical vulnerabilities