The components for the first two were NSS (Network Security Services, not Name Service Switch) and GCC, and the third was Kerberos. I don't have the BZ number handy right now.
For the first two it's probably that they were considered not bad enough for an asynchronous release. With CentOS Stream, you would have a better understanding of when the patch was committed and more certainty of whether it would be fixed in the next minor (6-months cadence) release.
Feel free to write to me at pbonzini@redhat.com, I don't work on Kerberos myself but I know people in the team.