vuln·telMCP serverToolsNew in scopeGuidesField notesGet a key

New in bug bounty scope: week 35, 2026

Aug 24 to Aug 30, 2026 · published 2026-11-03

33 assets newly entered public bug-bounty scope in week 35 of 2026 (Aug 24 to Aug 30, 2026) on 10 programs: Visa, Matomo, MoonPay, Aiven Managed Bug Bounty and 6 more. Each asset was checked against its program's own scope history: 13 raw additions that week were assets put back after a removal and 45 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

FindOut InfoVis AB - Marketplace Bug Bounty Program

Bugcrowd · up to $1,500 · 1 new asset

  • 1 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1218391/dependency-map-for-jira-link-viewer?hosting=cloud · url

BrizoIT

Bugcrowd · up to $1,500 · 6 new assets

  • 6 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1213545/work-time-tracking-calendar-for-jira?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1213545/work-time-tracking-calendar-for-jira?hosting=datacenter&tab=overview · url
    • https://marketplace.atlassian.com/apps/1217938/company-calendar-for-jira?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1217938/company-calendar-planner-for-jira?hosting=datacenter&tab=overview · url
    • https://marketplace.atlassian.com/apps/1222150/gantt-suite-for-jira?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1222150/gantt-suite-for-jira?tab=overview&hosting=datacenter · url

Caelor Group

Bugcrowd · up to $1,500 · 9 new assets

  • 9 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1221754/translator-for-confluence?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1222649/macrosuite-easy-html-button-hide-content-divider-tabs?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1223471/trophies-for-confluence-gamification?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1223472/trophies-for-jira-gamification?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1224103/cards-panels?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1225290/moscow-agile-prioritization-with-forge?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1230161/linksy-advanced-issue-linking?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1230540/cosmos-intranet-for-confluence?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1231591/shoppie-assets-integrated-shop-for-jsm?hosting=cloud&tab=overview · url

META-INF

Bugcrowd · up to $1,500 · 7 new assets

  • 7 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1218865/advanced-children-display-for-confluence?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1219628/glass-project-documentation-for-jira?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1224984/glass-project-information-for-jira?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1229346/marketplace-integration-for-jira?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/3762467523/myra-csat-nps-ces-feedback-hub-for-jsm?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/4909/content-exporter-word-pdf-html?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/4977/email-this-issue?hosting=cloud&tab=overview · url

Navarambh

Bugcrowd · up to $1,500 · 1 new asset

  • 1 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1222843/aio-tests-for-jira?hosting=cloud&tab=overview · url

New assets on existing programs

Visa

HackerOne · 4 new assets

  • https://usa.visa.com/gateway/api · url · max severity critical · since 2026-08-25
  • https://ebctest.cybersource.com/bos · url · max severity critical · since 2026-08-26
  • https://ebctest.cybersource.com/underwriting · url · max severity critical · since 2026-08-26
  • https://ebctest.cybersource.com/vroom · url · max severity critical · since 2026-08-27

Matomo

HackerOne · 2 new assets

  • https://github.com/matomo-org/developer-documentation · source · max severity low · since 2026-08-28
  • https://github.com/matomo-org/tracker-proxy · source · max severity medium · since 2026-08-28

MoonPay

HackerOne · 1 new asset

  • *.iron.xyz · wildcard · max severity critical · since 2026-08-25

Aiven Managed Bug Bounty

Bugcrowd · up to $25,000 · 1 new asset

  • 1 scope item described in words
    • Third-party dependency versions · other

HackerOne

HackerOne · 1 new asset · 614 publicly disclosed reports, most often: Information Disclosure (151), Violation of Secure Design Principles (88), Improper Access Control - Generic (36)

  • 1 scope item described in words
    • https://hackerone.com/mcp · other

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.