Cockpit's most recent CentOS 10 image refresh included an update of appstream-data from 1:10-20240326.1.el10 to 40-5.el10. The version number is suspicious already (indicating Fedora instead of RHEL), and the contents confirms that: /usr/share/swcatalog/xml/fedora.xml.gz now e.g. contains packages cockpit-sosreport, cockpit-networking, and cockpit-selinux which don't exist in RHEL (these are bundled into cockpit-system).

See http://download.devel.redhat.com/rhel-10/nightly/RHEL-10-Public-Beta/latest-RHEL-10/compose/AppStream/x86_64/os/Packages/ , it's the currently published version. Same in CentOS 10.

So this looks like an overzealous sync or misbuild?