vuln·telMCP serverToolsNew in scopeGuidesField notesGet a key

New in bug bounty scope: week 17, 2026

Apr 20 to Apr 26, 2026 · published 2026-11-03

25 assets newly entered public bug-bounty scope in week 17 of 2026 (Apr 20 to Apr 26, 2026) on 7 programs: Dossier Medical Partagé Bug Bounty Program, Mon Espace Santé (MES), Meesho, Crypto.com and 3 more. Each asset was checked against its program's own scope history: 10 raw additions that week were assets put back after a removal and 12 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Dossier Medical Partagé Bug Bounty Program

YesWeHack · up to $ 2,000 · 10 new assets

  • api.dmp.gouv.fr · api · since 2026-04-20
  • auth.dmp.gouv.fr · url · since 2026-04-20
  • https://sip2.dmp.gouv.fr · url · since 2026-04-20
  • https://www.dmp.fr · url · since 2026-04-20
  • https://www.dmp.gouv.fr · url · since 2026-04-20
  • lps.dmp.gouv.fr · url · since 2026-04-20
  • lps2.dmp.gouv.fr · url · since 2026-04-20
  • web-mh.dmp.gouv.fr · url · since 2026-04-20
  • wps-cps.cv.dmp.gouv.fr · url · since 2026-04-20
  • wps-cps.dmp.gouv.fr · url · since 2026-04-20

New assets on existing programs

Mon Espace Santé (MES)

YesWeHack · up to $ 8,000 · 9 new assets

  • admincms.developer.monespacesante.fr · url · since 2026-04-20
  • adminstore.developer.monespacesante.fr · url · since 2026-04-20
  • am.developer.monespacesante.fr · url · since 2026-04-20
  • api.developer.monespacesante.fr · api · since 2026-04-20
  • editeurs.developer.monespacesante.fr · url · since 2026-04-20
  • fhir.developer.monespacesante.fr · url · since 2026-04-20
  • fhir.monespacesante.fr · url · since 2026-04-20
  • knowage.developer.monespacesante.fr · url · since 2026-04-20
  • wps-cps.dmp.monespacesante.fr · url · since 2026-04-20

Meesho

HackerOne · 2 new assets

  • investor.meesho.com · url · max severity low · since 2026-04-20
  • meesho.io · url · max severity low · since 2026-04-20

Crypto.com

HackerOne · 1 new asset

  • https://explorer.cronos.org/token/0x2e53c5586e12a99d4CAE366E9Fc5C14fE9c6495d · other · max severity critical · since 2026-04-22

Superbet

HackerOne · 1 new asset

  • *.superbet.gr · wildcard · max severity critical · since 2026-04-23

Stiltsoft

Bugcrowd · up to $3,000 · 1 new asset

  • 1 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1899492230/live-tables-from-csv-json-for-confluence?hosting=cloud&tab=overview · url

Spotify

HackerOne · 1 new asset

  • 1 scope item described in words
    • DRM (Digital Rights Management) System · other

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.