Jenkins Project Jenkins Parameterized Remote Trigger Plugin

• CVE-2026-84676 Medium 4.3 Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read perm 0.2%
• CVE-2026-70438 Medium 4.3 A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. 0.3%
• CVE-2020-2239 Unrated Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to 0.5%