Patches for those security issues are embargoed until specified dates. Red Hat simply cannot add them to CentOS stream before that date.