diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 7b86371b9820..708e39578834 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -47,13 +47,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-8";
+  version = "7.1.1-9";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-2wAm2y8YQwhgsPNqxGGJ65emL/kMYoVvF2phZMXTpZc=";
+    hash = "sha256-xTrkQpd4UYHEmHosb7ZLoqnDFSutrikjXPmuU5R9jQo=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/networking/browsers/palemoon/default.nix b/pkgs/applications/networking/browsers/palemoon/default.nix
index 69350e155599..c7b1bb9f655b 100644
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@@ -45,7 +45,7 @@ assert with lib.strings; (
 
 stdenv.mkDerivation rec {
   pname = "palemoon";
-  version = "32.1.1";
+  version = "32.2.0";
 
   src = fetchFromGitea {
     domain = "repo.palemoon.org";
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     repo = "Pale-Moon";
     rev = "${version}_Release";
     fetchSubmodules = true;
-    sha256 = "sha256-Z9dBYO5AGDYRLlnEfHUu6thgc2a8OK/tPuRzwp0j9J8=";
+    sha256 = "sha256-ftY3xSvpAdjnoPsNNL+XyVD6hFPRmReLyrYT5pqSNho=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/frr/default.nix b/pkgs/servers/frr/default.nix
index 1215fbd34094..4936947402d4 100644
--- a/pkgs/servers/frr/default.nix
+++ b/pkgs/servers/frr/default.nix
@@ -48,6 +48,21 @@ stdenv.mkDerivation rec {
       url = "https://github.com/FRRouting/frr/commit/ff6db1027f8f36df657ff2e5ea167773752537ed.patch";
       sha256 = "sha256-b3nT6xco620hMSqlj/nTWTJCegf3ARAGaQbii4Yq6Ag=";
     })
+    (fetchpatch {
+      name = "CVE-2022-43681.patch";
+      url = "https://github.com/FRRouting/frr/commit/766eec1b7accffe2c04a5c9ebb14e9f487bb9f78.patch";
+      sha256 = "sha256-3XubiKvQos9QLQ4PaY89LLvLBjfYGoo6prulUgPXRgU=";
+    })
+    (fetchpatch {
+      name = "CVE-2022-40302.patch";
+      url = "https://github.com/FRRouting/frr/commit/3e46b43e3788f0f87bae56a86b54d412b4710286.patch";
+      sha256 = "sha256-GlTJcoPg2BFw3JBSFEQk2CMEGGbYfXOPqsTjIoSe8WY=";
+    })
+    (fetchpatch {
+      name = "CVE-2022-40318.patch";
+      url = "https://github.com/FRRouting/frr/commit/1117baca3c592877a4d8a13ed6a1d9bd83977487.patch";
+      sha256 = "sha256-txvpQZlqOyUl4kQ4VkLCUqSiA0lLdFt3uJdurnpJblM=";
+    })
   ];
 
   nativeBuildInputs = [