vuln·telMCP serverToolsNew in scopeGuidesField notesGet a key

New in bug bounty scope: week 22, 2026

May 25 to May 31, 2026 · published 2026-11-03

12 assets newly entered public bug-bounty scope in week 22 of 2026 (May 25 to May 31, 2026) on 3 programs: Crowdstrike, Marvelution, Stripe. Each asset was checked against its program's own scope history: 2 raw additions that week were assets put back after a removal and 5 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Marvelution

Bugcrowd · up to $1,500 · 5 new assets

  • 5 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1211376/jenkins-integration-for-jira?hosting=cloud&tab=overview · other
    • https://marketplace.atlassian.com/apps/1211376/jenkins-integration-for-jira?hosting=datacenter&tab=overview · other
    • https://marketplace.atlassian.com/apps/1211376/jenkins-integration-for-jira?hosting=server&tab=overview · other
    • https://marketplace.atlassian.com/apps/1234756/jenkins-for-compass?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1236248/jenkins-for-confluence/?tab=overview&hosting=cloud · url

New assets on existing programs

Crowdstrike

HackerOne · 2 new assets

  • sgnl.ai · url · max severity critical · since 2026-05-29
  • sgnl.team · url · max severity critical · since 2026-05-29

Stripe

HackerOne · 5 new assets · 27 publicly disclosed reports, most often: Improper Access Control - Generic (5), Insecure Direct Object Reference (IDOR) (3), Cross-Site Request Forgery (CSRF) (3)

  • 5 scope items described in words
    • Customer Portal · other
    • Global Payouts · other
    • Stripe CLI · other
    • Stripe Projects · other
    • Stripe fiat-to-crypto onramp · other

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.