Re: CVE's and patching
Those are all OpenSSH vulnerabilities. I do not see do those have to do with WinSCP. What security scan are you using?
Before posting, please read how to report bug or request support effectively.
Bug reports without an attached log file are usually useless.