The upper management and security team came knocking and told us all of the CVEs from the scanner need to be addressed right now. And the only way to deploy without having to wait for QA approval is to not merge feature changes.

You need a better product management. If they can't see what's going on at the moment, they truly suck at their job or management is putting pressure.