CVE's and patching

https://www.cve.org/CVERecord?id=CVE-2018-20685
https://www.cve.org/CVERecord?id=CVE-2019-6109
https://www.cve.org/CVERecord?id=CVE-2019-6111

We are running the latest updated 6.3.5 and a security scan shows this version to be vulnerable to these CVE's, is there a patch incoming for this?

Those are all OpenSSH vulnerabilities. I do not see do those have to do with WinSCP. What security scan are you using?