Don't use the :cve: RST role, it doesn't exist yet

Author: encukou

Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst

@@ -2,4 +2,4 @@
 installed by monkey-patching the private ``_get_decompressor()`` to return an
 object that only implements old BZ2Decompressor API from Python 3.3.
 Note that decompressors without ``needs_input`` and two-argument
-``decompress()`` are vulnerable to :cve:`2026-15310`.
+``decompress()`` are vulnerable to CVE 2026-15310.