As per the documentation  the types returned by GetUpdates() should describe the severity of the update, like "security" or "enhancement". This seems to (by and large) work on CentOS 7 with yum:
# pkcon get-updates
Normal tzdata-2017b-1.el7.noarch (updates) Timezone data
However, on Fedora 25 and 26, the type is always "Available":
Available tzdata-2017b-1.fc25.noarch (updates) Timezone data
Available weechat-1.7.1-1.fc25.x86_64 (updates) Portable, fast, light and extensible IRC client
In this cases, tzdata is a normal update and weechat is a security update. "
sudo dnf updateinfo info" does have the correct types, so the information is available in general:
Update ID : FEDORA-2017-24b0b27b9f
Type : enhancement
Update ID : FEDORA-2017-20dd9f26cf
Type : security
This is with PackageKit-1.1.5-1.fc25.x86_64.
We moved the upstream bugtracker to GitHub a long time ago. If this issue still affects you please re-create the issue here: https://github.com/hughsie/PackageKit/issues
Sorry for the impersonal message, and fingers crossed your issue no longer happens. Thanks.
Still applies to current versions, I filed it as https://github.com/hughsie/PackageKit/issues/268