vuln·telMCP serverToolsNew in scopeGuidesField notesGet a key

New in bug bounty scope: week 11, 2026

Mar 9 to Mar 15, 2026 · published 2026-11-03

35 assets newly entered public bug-bounty scope in week 11 of 2026 (Mar 9 to Mar 15, 2026) on 9 programs: WisdomTree, Inc., Intercom, HubSpot, X / xAI and 5 more. Each asset was checked against its program's own scope history: 1 raw additions that week were assets put back after a removal and 1 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

ProjectBalm

Bugcrowd · up to $1,500 · 1 new asset

  • 1 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1213146/risk-register?hosting=cloud · other

weweave GmbH Marketplace Bug Bounty

Bugcrowd · up to $1,500 · 24 new assets

  • 24 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1220302/data-tables-for-confluence?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1221789/youtube-for-confluence?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1221832/jsfiddle-for-confluence?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1221973/content-tools-for-confluence?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1222532/prism-syntax-highlighter-for-confluence?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1222562/flowchart-processes-for-confluence?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1222572/mermaid-charts-diagrams-for-confluence?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1222572/mermaid-charts-diagrams-for-confluence?tab=overview&hosting=datacenter · url
    • https://marketplace.atlassian.com/apps/1222572/mermaid-charts-diagrams-for-confluence?tab=overview&hosting=server · url
    • https://marketplace.atlassian.com/apps/1222612/chart-js-diagrams-for-confluence-cloud · url
    • https://marketplace.atlassian.com/apps/1222737/jsbarcode-for-confluence?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1223493/custom-css-code-for-confluence?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1223533/?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1224009/content-mirror-for-confluence?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1224394/?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1224537/?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1225264/?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1226668/dynamic-status-labels-for-confluence?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1226741/?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1227226/?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1228296/rapidoc-openapi-swagger-specification-ui-for-confluence?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1229317/?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1235463/?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1236260/?tab=overview&hosting=cloud · url

New assets on existing programs

WisdomTree, Inc.

HackerOne · 3 new assets

  • https://app.wisdomtreeconnect.com · url · max severity critical · since 2026-03-10
  • https://app.wisdomtreeconnect.com/api/ · url · max severity critical · since 2026-03-10
  • https://app.wisdomtreeconnect.com/o/token/ · url · max severity critical · since 2026-03-10

Intercom

Bugcrowd · up to $6,000 · 2 new assets

  • https://app.fin.ai/ · url · since 2026-03-12
  • https://fin.ai/ · url · since 2026-03-12

HubSpot

HackerOne · 1 new asset · 1 publicly disclosed report, most often:

  • hubspot.net · url · max severity medium · since 2026-03-11

The Browser Company of NYC

HackerOne · 1 new asset

  • 1 scope item described in words
    • Dia Assistant · other

Stripe

HackerOne · 1 new asset · 27 publicly disclosed reports, most often: Improper Access Control - Generic (5), Insecure Direct Object Reference (IDOR) (3), Cross-Site Request Forgery (CSRF) (3)

  • 1 scope item described in words
    • Munkisrv Open Source Project · other

TikTok

HackerOne · 1 new asset · 119 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Reflected (17), Insecure Direct Object Reference (IDOR) (17), Cross-Site Request Forgery (CSRF) (12)

  • 1 scope item described in words
    • Other Asset (Campaigns) · other

X / xAI

HackerOne · 1 new asset · 250 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Generic (34), Improper Authentication - Generic (31), Information Disclosure (23)

  • 1 named under *.x.com, already in scope
    • money.x.com · url

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.