New in bug bounty scope: week 21, 2026
9 assets newly entered public bug-bounty scope in week 21 of 2026 (May 18 to May 24, 2026) on 5 programs: Arlo Cash Rewards, Wise (ex-TransferWise), OPPO, Nemetschek and 1 more. Each asset was checked against its program's own scope history: 0 raw additions that week were assets put back after a removal and 2 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.
New programs
Nemetschek
2 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1219230/advanced-portal-reports-for-service-desk?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1234378/modify-my-request?hosting=cloud&tab=overview· url
STAGIL Marketplace Bug Bounty
3 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1211243/timetracker-time-tracking-timesheet-reporting-for-jira?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1215311/stagil-assets-advanced-links-data-model-matrix-structure?tab=overview&hosting=cloud· urlhttps://marketplace.atlassian.com/apps/1219099/stagil-tables-todo-checklists-reports-statistics?hosting=cloud&tab=overview· url
New assets on existing programs
Arlo Cash Rewards
https://*dev*.arlo.com· url · since 2026-05-19https://*qa*.arlo.com· url · since 2026-05-19
Wise (ex-TransferWise)
https://wise-sandbox.com/· url · since 2026-05-18
OPPO
https://e-global.heytap.com/marketing/login· url · max severity critical · since 2026-05-18
← previous week · all weeks · next week →
An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.