Centos – How to install the latest g++ version on CentOS

As far as security fixes are concerned, you're all set; your compliance scanner is the one that's wrong.

A lot of those scanners do their vulnerability detection via a check of the version string (in this case, a check of the string that OpenSSH sends to connecting clients including its version), which often leads to false positives when those scanners assume "issue X was fixed in OpenSSH version 5.whatever). Try changing an Apache server to ServerTokens Major and watch the scanner light up with a bunch of 2.0 vulnerabilities, regardless of what version you're actually on.

Figure out exactly what vulnerabilities the scan thinks you have, find them in the RPM's changelog, and send your scan vendor the version that you're on as proof that the scan's detection is a false positive. And this link, for good measure.

Not directly. Grab the SRPM from Fedora and rebuild using mock. Note that this will not quite work with yum since you'll have to handle updates yourself by repeating the procedure.