Two new mrubyc advisories

rubies/mrubyc/CVE-2026-38973.yml

@@ -0,0 +1,24 @@
+---
+engine: mrubyc
+cve: 2026-38973
+ghsa: r4w3-7jp7-m9g5
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-38973
+title: mrubyc through release3.4.1 was found to contain an out of bounds read
+date: 2026-07-06
+description: |
+  mrubyc through release 3.4.1 was found to contain an out-of-bounds
+  read in builtin missing-method lookup inside mrbc_find_method().
+cvss_v3: 4.4
+patched_versions:
+  - ">= 4.0.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-38973
+    - https://github.com/mrubyc/mrubyc/releases/tag/release4.0.0
+    - https://github.com/mrubyc/mrubyc/compare/release3.4.1...release4.0.0
+    - https://github.com/mrubyc/mrubyc/commit/f83a8b67ca1c7c62ac0dd548a363d79f767c4e30
+    - https://github.com/mrubyc/mrubyc/issues/279
+    - https://github.com/advisories/GHSA-r4w3-7jp7-m9g5
+notes: |
+  - cvss_v3 and date came from nvd.nist.gov URL.
+  - GHSA is unreviewed.

rubies/mrubyc/CVE-2026-38976.yml

@@ -0,0 +1,25 @@
+---
+engine: mrubyc
+cve: 2026-38976
+ghsa: ff2c-rpvx-jp6m
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-38976
+title: mrubyc through 3.4.1 was found to contain a NULL pointer dereference
+date: 2026-07-06
+description: |
+  mrubyc through 3.4.1 was found to contain a NULL pointer dereference
+  in src/vm.c in op_super() / OP_SUPER due to a missing runtime
+  guard for top-level super.
+cvss_v3: 7.5
+patched_versions:
+  - ">= 4.0.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-38976
+    - https://github.com/mrubyc/mrubyc/releases/tag/release4.0.0
+    - https://github.com/mrubyc/mrubyc/compare/release3.4.1...release4.0.0
+    - https://github.com/hayat01sh1da/mrubyc/commit/c4aa2a06bfdd13a0f1ae5165c5760a2530314a42
+    - https://github.com/mrubyc/mrubyc/issues/276
+    - https://github.com/advisories/GHSA-ff2c-rpvx-jp6m
+notes: |
+  - cvss_v3 and date came from nvd.nist.gov URL.
+  - GHSA is unreviewed.