diff --git a/pkgs/applications/networking/sniffers/sngrep/default.nix b/pkgs/applications/networking/sniffers/sngrep/default.nix
index f105450034ed..9adb7117808f 100644
--- a/pkgs/applications/networking/sniffers/sngrep/default.nix
+++ b/pkgs/applications/networking/sniffers/sngrep/default.nix
@@ -3,6 +3,7 @@
 , autoconf
 , automake
 , fetchFromGitHub
+, fetchpatch
 , libpcap
 , ncurses
 , openssl
@@ -20,6 +21,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-gFba2wOU4GwpOZTo5A2QpBgnC6OgDJEeyaPGHbA+7tA=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2023-36192.patch";
+      url = "https://github.com/irontec/sngrep/commit/ad1daf15c8387bfbb48097c25197bf330d2d98fc.patch";
+      hash = "sha256-g8fxvxi3d7jmZEKTbxqw29hJbm/ShsKKxstsOUGxTug=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoconf
     automake
diff --git a/pkgs/servers/clickhouse/default.nix b/pkgs/servers/clickhouse/default.nix
index 3ca09841b67a..fb56c3241842 100644
--- a/pkgs/servers/clickhouse/default.nix
+++ b/pkgs/servers/clickhouse/default.nix
@@ -28,7 +28,7 @@ let
     else llvmPackages.stdenv).mkDerivation;
 in mkDerivation rec {
   pname = "clickhouse";
-  version = "23.3.8.21";
+  version = "23.3.10.5";
 
   src = fetchFromGitHub rec {
     owner = "ClickHouse";
@@ -36,7 +36,7 @@ in mkDerivation rec {
     rev = "v${version}-lts";
     fetchSubmodules = true;
     name = "clickhouse-${rev}.tar.gz";
-    hash = "sha256-bynr196H6g/GmvNTtrfB6QDdAScvYvbe7EIceoOwCKc=";
+    hash = "sha256-xvmZOJqXrGToQRoEl+4AL9ewUhNdKGZFnCdBnSlB+tk=";
     postFetch = ''
       # delete files that make the source too big
       rm -rf $out/contrib/llvm-project/llvm/test
diff --git a/pkgs/tools/misc/pipreqs/default.nix b/pkgs/tools/misc/pipreqs/default.nix
index 70a5ec69ff51..b37760465c2d 100644
--- a/pkgs/tools/misc/pipreqs/default.nix
+++ b/pkgs/tools/misc/pipreqs/default.nix
@@ -4,11 +4,11 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "pipreqs";
-  version = "0.4.11";
+  version = "0.4.13";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c793b4e147ac437871b3a962c5ce467e129c859ece5ba79aca83c20f4d9c3aef";
+    hash = "sha256-oX8WeIC2khvjdTPOTIHdxuIrRlwQeq1VfbQ7Gt1WqZs=";
   };
 
   propagatedBuildInputs = [ yarg docopt ];