Threats affecting pkg:github/pgvector/pgvector

CVE-2026-103484 is a high-severity vulnerability in pgvector versions before 0.8.7. It involves an out-of-bounds write during the IVFFlat index build process, which can allow a database user with privileges to execute arbitrary code. This vulnerability has a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability.

Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.

Buffer overflow in parallel HNSW index build in pgvector 0.6.0 through 0.8.1 allows a database user to leak sensitive data from other relations or crash the database server.