You might want to check the errata for the packages your scanning tools complained about. Rhel will keep stable versions at the same release version, but backport security fixes in.
Many security scanners are stupid about this.
Since it is rhel, you have a support contract, right? What do they say?