Polymail, Inc.: XSPA on API service endpoint

Batch endpoint on the api was vulnerable to XSPA due to incorrect validation of url parameter in the request body...

Polymail, Inc.: [share.polymail.io] XSS when uploading a file to the server

Files uploaded to Polymail could contain javascript. This has now been mitigated and resolved...