Add CVEs to NEWS file

Related: RHEL-188852

NEWS

@@ -8,6 +8,17 @@ New in release OpenJDK 8u502 (2026-07-21):
 Live versions of these release notes can be found at:
   * https://bit.ly/openjdk8u502
 
+* CVEs
+  - CVE-2026-46968
+  - CVE-2026-47010
+  - CVE-2026-47021
+  - CVE-2026-47027
+  - CVE-2026-60147
+  - CVE-2026-47059
+  - CVE-2026-47063
+  - CVE-2026-47057
+  - CVE-2026-47058
+  - CVE-2026-41254
 * Changes
   - JDK-6815126: intermittent SimulResumerTest.java failure
   - JDK-8162545: Mac build failure

java-1.8.0-openjdk.spec

@@ -18,8 +18,8 @@
 %global updatever       %(VERSION=%{whole_update}; echo ${VERSION##*u})
 # eg jdk8u60-b27 -> b27
 %global buildver        %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global portablerelease 1
-%global rpmrelease 2
+%global portablerelease 2
+%global rpmrelease 1
 
 # Define IcedTea version used for SystemTap tapsets and desktop files
 %global icedteaver      3.15.0
@@ -2961,6 +2961,10 @@ cjc.mainProgram(args)
 %endif
 
 %changelog
+* Mon Jul 27 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.502.b07-2.1
+- Add CVEs to NEWS file
+- Related: RHEL-188852
+
 * Sat Jul 18 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.502.b07-1.2
 - Bump release for PQC build
 - Related: RHEL-212095