Read the docs

Tata Motors

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

Tata Motors records in CISA KEV

No Tata Motors vulnerabilities are listed in CISA KEV.

Records

4 records

TI-2026-85044 CVE-2026-121144 · GHSA-vp94-gjhf-w8x3

Hardcoded credentials in Tata Motors iRA and iRA.ev mobile app

Priority MEDIUM 44

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00301 Published 2026-11-04 No fix listed CWE-798
TI-2026-85059 CVE-2026-121147 · GHSA-8x7g-wrmc-g29j

Weak certificate pinning in Tata Motors iRA and iRA.ev mobile apps

Priority LOW 37

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning contro…

CVSS 4.0HIGH 8.5 Adjacent network No auth User interaction EPSS 0.00088 Published 2026-11-04 No fix listed CWE-295
TI-2026-85045 CVE-2026-121145 · GHSA-4v32-7h8r-xjwp

Insufficient URL validation in Tata Motors iRA and iRA.ev app WebView

Priority LOW 31

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00212 Published 2026-11-04 No fix listed CWE-346
TI-2026-85058 CVE-2026-121146 · GHSA-gmgc-5m52-m566

Authentication tokens logged by Tata Motors iRA and iRA.ev apps

Priority LOW 29

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00119 Published 2026-11-04 No fix listed CWE-532
Open these records in search →