I noticed a number of false positives in the Quay security scan for centos-bootc:stream10 images and others (see attached screenshot).

In this specific example, Quay claims that podman v5.2.2-1 uses runc v1.1.1-xxx.  However, this version of Podman (according the src rpm commit 458f9b42760bf79aae4a96d0610b22f317ac7714) uses runc v1.1.13 (see go.mod file) where all the issues are fixed.

Other scan results look legit.