Tata Motors has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was November 2026 with 4. The median CVSS is 7.8 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-121144High· 8.8Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application48CVE-2026-121147High· 8.5Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application47CVE-2026-121145High· 7.1Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application39CVE-2026-121146Medium· 6.8Information Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile application37
Tata Motors vulnerabilities
CVEs affecting Tata Motors, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-121147High· 8.5Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker p…
CVE-2026-121144High· 8.8Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could …
CVE-2026-121146Medium· 6.8Information Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile application
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vuln…
CVE-2026-121145High· 7.1Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web c…