CVE-2026-103484

HighCVSS 8.8/10Last modified Oct 2, 2026

Description

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787CWE-1284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 1, 2026
Last modified
Oct 2, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1034887.1In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access reCVE-2026-1034895.4In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possibleCVE-2026-1034907.2In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group linksCVE-2026-1034916.5In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issuesCVE-2026-1034926.5In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachmentsCVE-2026-1034938.1In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possibleCVE-2026-1034946.6In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changesCVE-2026-1034954.3In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogsCVE-2026-1034965.4In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notificationsCVE-2026-1034975.5In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integrationCVE-2026-1034997.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow CVE-2026-10353.1A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing re
CVE-2026-103484: High severity, CVSS 8.8 | Vulnix