vuln·telMCP serverToolsNew in scopeGuidesField notesGet a key

New in bug bounty scope: week 18, 2026

Apr 27 to May 3, 2026 · published 2026-11-03

54 assets newly entered public bug-bounty scope in week 18 of 2026 (Apr 27 to May 3, 2026) on 11 programs: Ripio, Visa, Opera Public Bug Bounty, OPPO and 7 more. Each asset was checked against its program's own scope history: 6 raw additions that week were assets put back after a removal and 11 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New assets on existing programs

Ripio

HackerOne · 14 new assets

  • https://basescan.org/address/0xf469eC9dEBf7F0adEBA4d1Db2FF5c70707bEeB30 · other · max severity critical · since 2026-04-29
  • https://etherscan.io/address/0x0DC4F92879B7670e5f4e4e6e3c801D229129D90D · other · max severity critical · since 2026-04-29
  • https://etherscan.io/address/0x337E7456B420bD3481e7FA61fA9850343d610d34 · other · max severity critical · since 2026-04-29
  • https://etherscan.io/address/0x46167cB034feC6ceC46CaeD4f61281f5Aa0Eb0e6 · other · max severity critical · since 2026-04-29
  • https://etherscan.io/address/0x465e642387d3d73a57CDc1368fFA53A800bA5D47 · other · max severity critical · since 2026-04-29
  • https://etherscan.io/address/0x4F34c8b3b5FB6D98Da888F0feA543d4d9C9F2eBE · other · max severity critical · since 2026-04-29
  • https://etherscan.io/address/0x61D450a098b6a7f69fC4b98CE68198fe59768651 · other · max severity critical · since 2026-04-29
  • https://etherscan.io/address/0x8a1D45e102e886510e891d2Ec656a708991e2D76 · other · max severity critical · since 2026-04-29
  • https://etherscan.io/address/0xD168CFbBE260D48cd119497a9a2eE8482080C5E7 · other · max severity critical · since 2026-04-29
  • https://etherscan.io/address/0xD76f5Faf6888e24D9F04Bf92a0c8B921FE4390e0 · other · max severity critical · since 2026-04-29
  • https://etherscan.io/address/0xdcC340132740AD57E9Fc90C9BD08B00dBbc87986 · other · max severity critical · since 2026-04-29
  • https://worldscan.org/address/0xDe7Ec97CFDeE9F20f9d256F4a0A0d694479fa2E0 · other · max severity critical · since 2026-04-29
  • 1 named under *.ripio.com, already in scope
    • https://bridge.ripio.com/ · url
  • 1 scope item described in words
    • Web3 - Smart Contracts Scope · other

Visa

HackerOne · 10 new assets

  • *.prod.innovexperiments.com · other · max severity critical · since 2026-04-28
  • admin-portal.api-xperience.com · url · max severity critical · since 2026-04-28
  • capability.prod.innovexperiments.com · url · max severity critical · since 2026-04-28
  • developers.pismo.io · url · max severity medium · since 2026-04-28
  • sap.api-xperience.com · url · max severity critical · since 2026-04-28
  • testbank.xs2a.com · url · max severity critical · since 2026-04-28
  • vgov.catalogue.digitalcontrolroom.com · url · max severity medium · since 2026-04-28
  • visainnovationprogram.com · url · max severity medium · since 2026-04-28
  • visaonchainanalytics.com · url · max severity medium · since 2026-04-28
  • visasgic.api-xperience.com · url · max severity critical · since 2026-04-28

Opera Public Bug Bounty

Bugcrowd · up to $5,000 · 9 new assets

  • api.gx.games/gms · api · since 2026-04-30
  • api.gx.games/gx · api · since 2026-04-30
  • api.gx.games/pub · api · since 2026-04-30
  • api.gx.me/me · api · since 2026-04-30
  • api.neon.opera.com/neon/pub · api · since 2026-04-30
  • api.neon.opera.com/neon/store · api · since 2026-04-30
  • api.neon.opera.com/pub · api · since 2026-04-30
  • https://gx.me · url · since 2026-04-30
  • https://neon.opera.com/cards/ · url · since 2026-04-30

OPPO

HackerOne · 8 new assets

  • com.katanlabs.bubblepop · other · max severity critical · since 2026-04-28
  • com.katanlabs.matchballgame · other · max severity critical · since 2026-04-28
  • com.katanlabs.worm.ioeatemall · other · max severity critical · since 2026-04-28
  • https://c.realme.com/eg/ · url · max severity critical · since 2026-04-28
  • https://c.realme.com/global/ · url · max severity critical · since 2026-04-28
  • https://c.realme.com/id/ · url · max severity critical · since 2026-04-28
  • https://c.realme.com/in/ · url · max severity critical · since 2026-04-28
  • https://c.realme.com/ru/ · url · max severity critical · since 2026-04-28

Tools for Humanity

HackerOne · 7 new assets · 4 publicly disclosed reports, most often: Business Logic Errors (1), Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (1), Cross-Site Scripting (XSS) (1)

  • https://github.com/worldcoin/orb-core · source · max severity critical · since 2026-04-27
  • https://github.com/worldcoin/orb-firmware · source · max severity critical · since 2026-04-27
  • https://github.com/worldcoin/orb-messages · source · max severity critical · since 2026-04-27
  • https://github.com/worldcoin/orb-relay-messages · source · max severity critical · since 2026-04-27
  • https://github.com/worldcoin/orb-rustzone · source · max severity critical · since 2026-04-27
  • https://github.com/worldcoin/orb-secure-element · source · max severity critical · since 2026-04-27
  • https://github.com/worldcoin/orb-software · source · max severity critical · since 2026-04-27

SAP Invitational Bug Bounty Program

Bugcrowd · up to $20,000 · 1 new asset

  • Gardener · url · since 2026-04-28

Navan

Bugcrowd · up to $4,500 · 1 new asset

  • https://app.navan.com · url · since 2026-04-30

BookBeat

YesWeHack · up to $ 2,000 · 1 new asset

  • edge.bookbeat.com · api · since 2026-04-28

Automattic

HackerOne · 1 new asset · 166 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Stored (23), Cross-site Scripting (XSS) - Generic (20), Improper Authentication - Generic (11)

  • parse.ly · url · max severity critical · since 2026-04-27

Banco Plata

HackerOne · 1 new asset

  • *.bancoplata.mx · wildcard · max severity critical · since 2026-04-27

Remitly

HackerOne · 1 new asset · 1 publicly disclosed report, most often: Improper Access Control - Generic (1)

  • login.remitly.com · url · max severity critical · since 2026-04-30

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.