daytonaio daytona

• CVE-2026-54320 High 8.4 Daytona: Cross-tenant organization takeover via invitation acceptance with an unverified email 0.4%
• CVE-2026-54321 High 7.0 Daytona: Public sandbox previews remain accessible for up to one hour after being made private 0.4%
• CVE-2026-54319 Medium 4.2 Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape 0.2%
• CVE-2026-54322 High 7.7 Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles 0.3%
• CVE-2026-54324 Medium 6.5 Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join 0.5%
• CVE-2026-54323 Medium 5.9 Daytona: Git credential leak via git clone with TLS verification disabled 0.2%