CVE-2026-121146

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session...

CVE-2026-121147

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this...

CVE-2026-121144

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application packag...

CVE-2026-121145

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of...

CVE-2026-121147

The iRA 2.0 and iRA.ev mobile applications (associated with Tata Motors ) are vulnerable to a security misconfiguration. The root cause is an improper implementation of SSL certificate pinning within the network security configuration, leading to ineffective certificate pinning controls. An attac...

EUVD-2026-116908

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this...

CVE-2026-121146

The iRA 2.0 and iRA.ev mobile applications by Tata Motors are vulnerable to an information disclosure flaw due to the recording of authentication tokens in application logs intended for development and debugging. A local attacker with access to these logs can retrieve and misuse the exposed sessi...

EUVD-2026-116907

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session...

EUVD-2026-116905

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of...

CVE-2026-121145

The iRA 2.0 and iRA.ev mobile applications are vulnerable due to insufficient validation of URLs and origins loaded within the WebView component . A remote attacker can exploit this by sending malicious web content to the affected WebView. Successful exploitation may allow an attacker to interact...

CVE-2026-121144

The iRA 2.0 and iRA.ev mobile applications (associated with Tata Motors ) are vulnerable to a hardcoded credentials flaw. The application packages contain hardcoded service account credentials, API Keys, and authorization tokens . An unauthenticated remote attacker can exploit this by downloading...

EUVD-2026-116892

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application packag...

CVE-2026-121147: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL…

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this...

PT-2026-136952

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of...

CVE-2026-121145: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and…

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of...

CVE-2026-121146: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens…

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session...

PT-2026-136951

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application packag...

CVE-2026-121144: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account…

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application packag...

PT-2026-136953

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session...

PT-2026-136954

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this...