vuln·telMCP serverToolsNew in scopeGuidesField notesGet a key

New in bug bounty scope: week 28, 2026

Jul 6 to Jul 12, 2026 · published 2026-11-03

64 assets newly entered public bug-bounty scope in week 28 of 2026 (Jul 6 to Jul 12, 2026) on 15 programs: Telenor Sweden Public Bug Bounty Program, 23andMe Bug Bounty, Hypixel Studios Managed Bug Bounty Engagement, Marionnaud and 11 more. Each asset was checked against its program's own scope history: 11 raw additions that week were assets put back after a removal and 3 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Hypixel Studios Managed Bug Bounty Engagement

Bugcrowd · up to $25,000 · 10 new assets

  • http://arcanitegames.ca/ · url · since 2026-07-09
  • https://accounts.hytale.com/login · url · since 2026-07-09
  • https://hytale.com/ · url · since 2026-07-09
  • https://hytale.dev/ · url · since 2026-07-09
  • https://store.hytale.com/ · url · since 2026-07-09
  • 5 scope items described in words
    • 3rd Party Integrations (Hytale-side issues only) · url
    • Hypixel Public APIs · api
    • Hytale Game Client · url
    • Hytale Game Server · other
    • Hytale Launcher · url

55 Degrees

Bugcrowd · up to $1,500 · 11 new assets

  • Anything related to the actionableagile.55degrees-apps.net subdomain is in scope. · url · since 2026-07-09
  • 10 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1216661/actionableagile-for-jira-agile-metrics?hosting=cloud · other
    • https://marketplace.atlassian.com/apps/1216661/actionableagile-for-jira-agile-metrics?hosting=cloud&tab=overview · other
    • https://marketplace.atlassian.com/apps/1216661/actionableagile-for-jira-agile-metrics?hosting=datacenter · other
    • https://marketplace.atlassian.com/apps/1216661/actionableagile-for-jira-agile-metrics?hosting=datacenter&tab=overview · other
    • https://marketplace.atlassian.com/apps/1216661/actionableagile-for-jira-agile-metrics?hosting=server · other
    • https://marketplace.atlassian.com/apps/1216661/actionableagile-for-jira-agile-metrics?hosting=server&tab=overview · other
    • https://marketplace.atlassian.com/apps/1220160/issue-analyzer-for-jira?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1224766/portfolio-forecaster?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1224766/portfolio-forecaster?hosting=datacenter&tab=overview · url
    • https://marketplace.atlassian.com/apps/1227773/klar-issue-refinement-for-jira?hosting=cloud&tab=overview · url

AppLiger

Bugcrowd · up to $1,500 · 4 new assets

  • 4 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1219112/easy-templates-for-jira-issues?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1236389/easy-progress-hill-charts-for-jira?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1236512/easy-action-items-checklist-templates-and-automation?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/2576221793/easy-markdown-exporter-for-confluence?hosting=cloud&tab=overview · url

Opus Guard Marketplace Managed Bug Bounty Engagement

Bugcrowd · up to $1,500 · 4 new assets

  • 4 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1233769/content-retention-manager-for-confluence?hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1234057/content-retention-manager-for-jira?hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1237739?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1237740?tab=overview&hosting=cloud · url

RV Softwares Marketplace Bug Bounty Program

Bugcrowd · up to $1,500 · 4 new assets

  • 4 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1223200/agile-tools-epic-tree-links-tree-time-in-status-worklogs?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1226187/time-in-status-reports?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1228019/issue-hierarchy-structure?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1230243/worklogs-time-tracking-timesheets?hosting=cloud&tab=overview · url

New assets on existing programs

23andMe Bug Bounty

HackerOne · 6 new assets

  • 23andme.org/ancestry/last-names · url · max severity critical · since 2026-07-09
  • 23andme.org/blog · url · max severity critical · since 2026-07-09
  • 23andme.org/clinicians · url · max severity critical · since 2026-07-09
  • 23andme.org/education · url · max severity critical · since 2026-07-09
  • 23andme.org/media-center · url · max severity critical · since 2026-07-09
  • 23andme.org/research · url · max severity medium · since 2026-07-09

Telenor Sweden Public Bug Bounty Program

YesWeHack · up to $ 6,000 · 15 new assets

  • ownit.se · url · since 2026-07-06
  • telenor.se · url · since 2026-07-06
  • vimla.se · url · since 2026-07-06
  • 10 named under *.ownit.se, *.telenor.se, *.vimla.se, already in scope
    • *.api-app.telenor.se · api
    • *.api.vimla.se · api
    • *.apis.telenor.se · api
    • *.foretagsportalen.telenor.se · url
    • *.mitt.vimla.se · url
    • *.mittforetag.telenor.se · url
    • *.play.ownit.se · url
    • *.profile.telenor.se · url
    • *.signin.telenor.se · url
    • *.stream.telenor.se · url
  • 2 listed on apps.apple.com, play.google.com
    • https://apps.apple.com/se/app/vimla/id1233271881 https://play.google.com/store/apps/details?id=com.vimlaapp&hl=en · mobile
    • https://play.google.com/store/apps/details?id=com.vimlaapp&hl=en · mobile

DigitalOcean

Intigriti · up to $10,000 · 1 new asset

  • inference.do-ai.run · url · max severity Tier 2 · since 2026-07-10

TheFork Managed Bug Bounty Engagement

Bugcrowd · up to $3,500 · 1 new asset

  • https://api-ws.thefork.com · api · since 2026-07-09

SIX Group

HackerOne · 1 new asset

  • http://ibt-test.six-group.com · url · max severity critical · since 2026-07-09

Temu

HackerOne · 1 new asset

  • ads.temu.com · url · max severity critical · since 2026-07-09

SAP Invitational Bug Bounty Program

Bugcrowd · up to $20,000 · 1 new asset

  • 1 scope item described in words
    • SAP Concur · url

Marionnaud

Intigriti · up to $8,500 · 3 new assets

  • 3 named under *.marionnaud.fr, *.marionnaud.ro, *.marionnaud.sk, already in scope
    • campaign.marionnaud.ro · url
    • campaign.marionnaud.sk · url
    • jeux-concours.marionnaud.fr · url

Figma

HackerOne · 1 new asset · 1 publicly disclosed report, most often: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (1)

  • 1 scope item described in words
    • Figma Weave · other

Hilton

HackerOne · 1 new asset

  • 1 scope item described in words
    • Managed Property Assets · other

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.