https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-13T01:35:29.710702+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-318853 EUVD-2026-318853 2026-10-13T01:35:29.712764+00:00 EUVD-2026-318853 https://cve.radiocsirt.org/vuln/fkie_cve-2017-20198 fkie_cve-2017-20198 2026-10-13T01:35:29.712791+00:00

The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement.

 https://cve.radiocsirt.org/vuln/ghsa-24rw-3m8c-crv2 GHSA-24rw-3m8c-crv2 2026-10-13T01:35:29.712823+00:00

The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement.