vuln·telMCP serverToolsNew in scopeGuidesField notesGet a key

New in bug bounty scope: week 24, 2026

Jun 8 to Jun 14, 2026 · published 2026-11-03

33 assets newly entered public bug-bounty scope in week 24 of 2026 (Jun 8 to Jun 14, 2026) on 10 programs: MercadoLibre, NVIDIA Public Bug Bounty, Airtable, Judge.me and 6 more. Each asset was checked against its program's own scope history: 16 raw additions that week were assets put back after a removal and 3 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

NVIDIA Public Bug Bounty

Intigriti · up to $15,000 · 11 new assets

  • NVCC · other · max severity Tier 2 · since 2026-06-11
  • 10 scope items described in words
    • new CDI-based architecture · other
    • All Other NVIDIA Container Toolkit Assets · other
    • CUDA Driver APIs · other
    • CUDA Libraries · other
    • CUDA Runtime APIs · url
    • NVIDIA Nsight Developer Tools · other
    • NVRTC library · other
    • Nsight Systems · other
    • libNVVM API · other
    • nvJitLink APIs · other

Broken Build Bug Bounty

Bugcrowd · up to $1,500 · 10 new assets

  • 10 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1212120/agile-reports-and-gadgets?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1214373/subcomponents-for-jira-cloud?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1215768/agile-velocity-chart-gadget?hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1235338/cycle-time-gadgets-time-in-status-trend-reports-for-jira?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1236240/burnup-burndown-chart-gadget-forecast-on-jira-dashboard?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/2501894527/throughput-charts-for-scrum-kanban-agile-gadgets-reports?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/2785074762/cumulative-flow-diagrams-cfd-for-jira-agile-charts-gadgets?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/2836020067/created-vs-resolved-charts-for-jira-agile-gadgets-reports?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/3709319691/monte-carlo-simulations-for-scrum-kanban-agile-gadgets?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/924938813/agile-wip-charts-for-scrum-kanban-safe-gadgets-reports?hosting=cloud&tab=overview · url

Dutch Beginners ZZP Marketplace Managed Bug Bounty Engagement

Bugcrowd · up to $1,500 · 1 new asset

  • 1 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1220001/visualize-openapi-swagger-documentation?hosting=cloud · url

Gliffy

Bugcrowd · up to $1,500 · 1 new asset

  • 1 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/254/gliffy-diagrams-for-confluence?hosting=cloud&tab=overview · url

J-Tricks - Marketplace Bug Bounty Program

Bugcrowd · up to $1,500 · 1 new asset

  • 1 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/31399/jql-tricks-plugin?hosting=cloud&tab=overview · url

New assets on existing programs

MercadoLibre

HackerOne · 4 new assets · 6 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Stored (2), Code Injection (1), Insecure Direct Object Reference (IDOR) (1)

  • mercadobackoffice.com · url · max severity critical · since 2026-06-11
  • mercadopago.com.ve · url · max severity critical · since 2026-06-11
  • mpago.la · url · max severity critical · since 2026-06-11
  • mpago.li · url · max severity critical · since 2026-06-11

Judge.me

HackerOne · 1 new asset · 18 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Stored (7), Command Injection - Generic (1), Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (1)

  • insights.judgeme.dev · url · max severity critical · since 2026-06-11

PortSwigger Web Security

HackerOne · 1 new asset · 40 publicly disclosed reports, most often: Information Disclosure (4), Business Logic Errors (4), Privilege Escalation (3)

  • id.portswigger.net · url · max severity critical · since 2026-06-09

TikTok

HackerOne · 1 new asset · 119 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Reflected (17), Insecure Direct Object Reference (IDOR) (17), Cross-Site Request Forgery (CSRF) (12)

  • *.soundon.global · wildcard · max severity critical · since 2026-06-08

Airtable

HackerOne · 2 new assets

  • 1 named under *.staging.airtable.com, already in scope
    • mcp.staging.airtable.com · url
  • 1 listed on www.npmjs.com
    • https://www.npmjs.com/package/@airtable/mcp-cli · source

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.