chagne disclosure order to be based release

Still a little hard to read, in order to identify older releases that are not fully patched

Author: jodygarnett

_posts/2025-06-10-cve-disclosure.md

@@ -18,12 +18,12 @@ The GeoServer community has readied the following CVE vulnerabilities for public
 * [CVE-2025-27505](https://github.com/geoserver/geoserver/security/advisories/GHSA-h86g-x8mm-78m5) Missing Authorization on REST API Index (Moderate)  
   Fixed: 2.26.3 | 2.25.6
 
-* [CVE-2024-40625](https://github.com/geoserver/geoserver/security/advisories/GHSA-r4hf-r8gj-jgw2) Coverage REST API Server Side Request Forgery (Moderate)  
-  Fixed: 2.26.0
-
 * [CVE-2024-38524](https://github.com/geoserver/geoserver/security/advisories/GHSA-jm79-7xhw-6f6f) GWC Home Page exposes sensitive server information (Moderate)  
   Fixed: 2.26.2 | 2.25.6
 
+* [CVE-2024-40625](https://github.com/geoserver/geoserver/security/advisories/GHSA-r4hf-r8gj-jgw2) Coverage REST API Server Side Request Forgery (Moderate)  
+  Fixed: 2.26.0
+
 * [CVE-2024-34711](https://github.com/geoserver/geoserver/security/advisories/GHSA-mc43-4fqr-c965) Improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) (High)  
   Fixed: 2.25.0