Linuxdeepin vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Linuxdeepin products: 1 record(s), with severity, exploitation and fixes.

Dde-control-center 1 Deepin-deepinid-plugin 1

Exploited only (KEV) →

CVE-2026-35207 Medium · 5.4 CWE-295 Apr 9, 2026

deepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote server

dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a plugin in dde-control-center, which provides the deepinid cloud service. Prior to 6.1.80, plugin-deepinid is configured to skip TLS certificate verification when fetching the user's avatar from openapi.deepin.com or other providers. An MITM attacker could intercept the traffic, replace the avatar with a malicious or misleading image, and potentially identify the user by the avatar. This vulnerability is fixed in dde-control-center 6.1.80 and 5.9.9.