New in bug bounty scope: week 3, 2026

Jan 12 to Jan 18, 2026 · published 2026-11-03

35 assets newly entered public bug-bounty scope in week 3 of 2026 (Jan 12 to Jan 18, 2026) on 7 programs: Unico IDtech, Epic Games, VFS Global Bug Bounty Program, Atlassian and 3 more. Each asset was checked against its program's own scope history: 5 raw additions that week were assets put back after a removal and 8 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

HPE Networking Product Public Program

Bugcrowd · up to $5,000 · 20 new assets

• *.central.arubanetworks.com · url · since 2026-01-15
• 19 scope items described in words

  • Aruba AirWave AMP · other
  • Aruba InstantOn Switches · other
  • Aruba User Experience Insight Sensors · device
  • ArubaOS-CX Switches · other
  • HPE Aruba Networking Central - New UI (see Scope Details) · url
  • HPE Aruba Networking ClearPass Policy Manager · other
  • HPE Aruba Networking EdgeConnect SD-WAN Orchestrator · other
  • HPE Aruba Networking Fabric Composer · ip
  • HPE Aruba Networking NetEdit · ip
  • HPE Aruba Networking Private 5G · url
  • HPE Aruba Networking SSE · other
  • HPE Aruba Networking VIA · other
  • HPE Aruba Networking Wireless - AOS-10.4 Access Points (AP) · ip
  • HPE Aruba Networking Wireless - AOS-10.4 Gateways (GW) · ip
  • HPE Aruba Networking Wireless - AOS-10.7 and above Access Points (AP) · ip
  • HPE Aruba Networking Wireless - AOS-10.7 and above Gateways (GW) · ip
  • HPE Aruba Networking Wireless - AOS-8 Controllers · other
  • HPE Aruba Networking Wireless - AOS-8 Instant AP (IAP) · ip
  • HPE Networking Instant On APs and supporting backend infrastructure · other

New assets on existing programs

Unico IDtech

HackerOne · 6 new assets

• accountshomolog.acesso.io · url · max severity critical · since 2026-01-14
• backend-sdk.uat.private.unico.run · url · max severity critical · since 2026-01-14
• identityhomolog.acesso.io · url · max severity critical · since 2026-01-14
• https://sdk-h1.unico.io/createprocess · url · max severity high · since 2026-01-16
• issuer.idpay-uat.unico.io · url · max severity critical · since 2026-01-16
• 1 scope item described in words

  • [Unico] Liveness Bypass · other

Epic Games

HackerOne · 4 new assets

• cosmo.fdeb.live.use1a.on.epicgames.com · url · max severity critical · since 2026-01-13
• https://fn-commerce-live.eeef.live.use1a.on.epicgames.com/api/fn-commerce/ · url · max severity critical · since 2026-01-13
• https://fngw-svc-ds-livefn.ol.epicgames.net/api/magpie · url · max severity critical · since 2026-01-13
• https://fngw-svc-gc-livefn.ol.epicgames.net/api/magpie · url · max severity critical · since 2026-01-13

VFS Global Bug Bounty Program

YesWeHack · up to $ 1,500 · 2 new assets

• phlonline.vfsevisa.cn · url · since 2026-01-14
• phlportal.vfsevisa.cn · url · since 2026-01-14

Atlassian

Bugcrowd · up to $12,000 · 1 new asset

• https://mcp.atlassian.com · other · since 2026-01-16

Circle

HackerOne · 1 new asset

• https://github.com/circlefin/solana-gateway-contracts · other · max severity critical · since 2026-01-14

Instacart

HackerOne · 1 new asset · 35 publicly disclosed reports, most often: Information Disclosure (6), Cross-site Scripting (XSS) - Generic (5), Violation of Secure Design Principles (4)

• template.uat.foodstorm.com · url · max severity critical · since 2026-01-14

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.