I don't know about CVE's specifically, but Konqueror's development (
https://projects.kde.org/projects/kde/applications/kde-baseapps/repository/revisions/master/show/konqueror) last src/ update was 4 months ago for one specific file-- every other file hasn't been touched in a year or more. From a security standpoint.. I'm retracting my thoughts around "Firefox or Rekonq" and instead opting for "Firefox or Chromium", and im not even sure if Chromium ever made it into Fedora's repos. Plus, were Rekonq or Konqueror ever ported to Frameworks? If not then neither of them are Wayland-native