diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 97df3865209b..fa3f60ffd64e 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -2,7 +2,7 @@
 let
   inherit (pkgs) callPackage fetchurl;
   versions = if stdenv.isLinux then {
-    stable = "0.0.20";
+    stable = "0.0.21";
     ptb = "0.0.29";
     canary = "0.0.135";
   } else {
@@ -20,7 +20,7 @@ let
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        sha256 = "3f7yuxigEF3e8qhCetCHKBtV4XUHsx/iYiaCCXjspYw=";
+        sha256 = "KDKUssPRrs/D10s5GhJ23hctatQmyqd27xS9nU7iNaM=";
       };
       ptb = fetchurl {
         url =
diff --git a/pkgs/applications/networking/mailreaders/sylpheed/default.nix b/pkgs/applications/networking/mailreaders/sylpheed/default.nix
index 9a65bec21c20..32350bb5cfa7 100644
--- a/pkgs/applications/networking/mailreaders/sylpheed/default.nix
+++ b/pkgs/applications/networking/mailreaders/sylpheed/default.nix
@@ -19,13 +19,17 @@ stdenv.mkDerivation rec {
     (fetchpatch {
       # patch upstream bug https://sylpheed.sraoss.jp/redmine/issues/306
       name = "patch-libsylph_ssl_c.patch";
+      extraPrefix = "";
       url = "https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/ports/mail/sylpheed/patches/patch-libsylph_ssl_c?rev=1.4&content-type=text/plain";
-      sha256 = "sha256-k9OwPtHrEjaxXdH0trNqXgJMhR8kjgtei9pi6OFvILk=";
+      sha256 = "sha256-+FetU5vrfvE78nYAjKK/QFZnFw+Zr2PvoUGRWCuZczs=";
+    })
+    (fetchpatch {
+      name = "CVE-2021-37746.patch";
+      url = "https://git.claws-mail.org/?p=claws.git;a=patch;h=ac286a71ed78429e16c612161251b9ea90ccd431";
+      sha256 = "sha256-oLmUShtvO6io3jibKT67eO0O58vEDZEeaB51QTd3UkU=";
     })
   ];
 
-  patchFlags = [ "-p0" ];
-
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ gtk2 ]
diff --git a/pkgs/servers/frr/default.nix b/pkgs/servers/frr/default.nix
index 5e5cd767002d..b78063840e86 100644
--- a/pkgs/servers/frr/default.nix
+++ b/pkgs/servers/frr/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 
 # build time
 , autoreconfHook
@@ -41,6 +42,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-zuOgbRxyyhFdBplH/K1fpyD+KUWa7FXPDmGKF5Kb7SQ=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-37032.patch";
+      url = "https://github.com/FRRouting/frr/commit/ff6db1027f8f36df657ff2e5ea167773752537ed.patch";
+      sha256 = "sha256-b3nT6xco620hMSqlj/nTWTJCegf3ARAGaQbii4Yq6Ag=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     bison