CVE's and patching

https://nvd.nist.gov/vuln/detail/cve-2018-20685
https://nvd.nist.gov/vuln/detail/cve-2019-6109
https://nvd.nist.gov/vuln/detail/cve-2019-6111

We are running the latest updated 6.3.5 and a security scan shows this version to be vulnerable to these CVE's, is there a patch incoming for this?

Those are all OpenSSH vulnerabilities. I do not see do those have to do with WinSCP. What security scan are you using?