Apache Flink — known CVE vulnerabilities

Every CVE whose affected-product data names Apache Flink, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (4)

• CVE-2026-35194 — CVSS 8.1 (high): Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query…
• CVE-2020-17518 — CVSS 7.5 (high): Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system…
• CVE-2020-17519 — CVSS 7.5 (high) — actively exploited: A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local…
• CVE-2020-1960 — CVSS 4.7 (medium): A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to…