BZ #26923 now has a CVE entry, so add a NEWS entry for it.
mentioned in commit 0858f464
mentioned in commit 3668134a
mentioned in commit 6fd634e9