vuln·telMCP serverToolsNew in scopeGuidesField notesGet a key

New in bug bounty scope: week 9, 2026

Feb 23 to Mar 1, 2026 · published 2026-11-03

10 assets newly entered public bug-bounty scope in week 9 of 2026 (Feb 23 to Mar 1, 2026) on 4 programs: Elastic, Flickr, VFS Global Bug Bounty Program, Ping Identity. Each asset was checked against its program's own scope history: 0 raw additions that week were assets put back after a removal and 24 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New assets on existing programs

Elastic

HackerOne · 6 new assets · 20 publicly disclosed reports, most often: Privilege Escalation (3), Cross-site Scripting (XSS) - Stored (3), Improper Access Control - Generic (3)

  • *.elasticaccelerationzone.co · wildcard · max severity critical · since 2026-02-24
  • *.elasticloud.wtf · wildcard · max severity critical · since 2026-02-24
  • *.elasticpartneracademy.com · wildcard · max severity critical · since 2026-02-24
  • *.estccdn.com · wildcard · max severity critical · since 2026-02-24
  • *.insight.io · wildcard · max severity critical · since 2026-02-24
  • *.prelert.com · wildcard · max severity critical · since 2026-02-24

Flickr

HackerOne · 2 new assets · 16 publicly disclosed reports, most often: Open Redirect (4), Business Logic Errors (2), Cross-site Scripting (XSS) - Stored (1)

  • modefestival.com · url · max severity critical · since 2026-02-27
  • www.whatismode.com · url · max severity critical · since 2026-02-27

VFS Global Bug Bounty Program

YesWeHack · up to $ 1,500 · 1 new asset

  • evisa.gov.mz · url · since 2026-02-24

Ping Identity

HackerOne · 1 new asset · 11 publicly disclosed reports, most often: Violation of Secure Design Principles (2), Cross-site Scripting (XSS) - Stored (1), Improper Access Control - Generic (1)

  • https://console.ort-one-pingone.com/?env=7f327541-54e0-4ba4-8335-65eac2a25b5e · url · max severity critical · since 2026-02-27

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.