Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Tata Motors Clear all filters
TI-2026-85059 CVE-2026-121147 · GHSA-8x7g-wrmc-g29j

Weak certificate pinning in Tata Motors iRA and iRA.ev mobile apps

Priority LOW 37

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning contro…

CVSS 4.0HIGH 8.5 Adjacent network No auth User interaction EPSS 0.00088 Published 2026-11-04 No fix listed CWE-295
TI-2026-85058 CVE-2026-121146 · GHSA-gmgc-5m52-m566

Authentication tokens logged by Tata Motors iRA and iRA.ev apps

Priority LOW 29

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00119 Published 2026-11-04 No fix listed CWE-532
TI-2026-85045 CVE-2026-121145 · GHSA-4v32-7h8r-xjwp

Insufficient URL validation in Tata Motors iRA and iRA.ev app WebView

Priority LOW 31

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00212 Published 2026-11-04 No fix listed CWE-346
TI-2026-85044 CVE-2026-121144 · GHSA-vp94-gjhf-w8x3

Hardcoded credentials in Tata Motors iRA and iRA.ev mobile app

Priority MEDIUM 44

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00301 Published 2026-11-04 No fix listed CWE-798