Stored XSS: Multiple fixes in message body rendering indicate a persistent risk of stored XSS from decrypted email HTML, with sanitization added in different layers (mapper, use case) over time.

Reflected XSS: Pasted content and header fields have been repeatedly patched, showing that multiple entry points (paste events, print header builder) can inject HTML if not sanitized consistently.

Path Traversal: Two separate fixes sanitize file names, indicating that unsanitized attachment names can lead to path traversal in different code paths (sharing and storage).