New in bug bounty scope: week 37, 2026

Sep 7 to Sep 13, 2026 · published 2026-11-03

78 assets newly entered public bug-bounty scope in week 37 of 2026 (Sep 7 to Sep 13, 2026) on 21 programs: Expedia Group Bug Bounty, eufy Security, FIS, Bitso Managed Bug Bounty Engagement and 17 more. Each asset was checked against its program's own scope history: 13 raw additions that week were assets put back after a removal and 5 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Kiteworks Public Bug Bounty Program

YesWeHack · up to $ 50,000 · 12 new assets

12 scope items described in words
- API Playground · url
- Crown Jewel Heist · other
- Email Protection Gateway (EPG) · url
- Kiteworks Android App · mobile
- Kiteworks Core · url
- Kiteworks Desktop Client 2.0 · other
- Kiteworks for Desktop · other
- Kiteworks for Office Desktop · other
- Kiteworks for Outlook Desktop · other
- Kiteworks iOS App · mobile
- Managed File Transfer (MFT) · url
- Secure Data Forms (SDF, aka Advanced Forms) · url

Cappsule Sarl - Marketplace Bug Bounty Program

Bugcrowd · up to $1,500 · 2 new assets

2 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1216988/timesheet-tracking-for-jira?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1235502/chart-factory-for-jira?hosting=cloud&tab=overview · url

Catapult Labs Bug Bounty

Bugcrowd · up to $1,500 · 8 new assets

8 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1215875/scrum-poker-estimates-for-confluence?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1216054/agile-retrospectives-for-confluence?hosting=datacenter&tab=overview · url
- https://marketplace.atlassian.com/apps/1216054/agile-retrospectives-for-confluence?tab=overview&hosting=cloud · url
- https://marketplace.atlassian.com/apps/1217825/standbot-slack-stand-up-bot-for-jira?tab=overview&hosting=cloud · url
- https://marketplace.atlassian.com/apps/1218860/agile-retrospectives-for-jira?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1218860/agile-retrospectives-for-jira?hosting=datacenter&tab=overview · url
- https://marketplace.atlassian.com/apps/1218960/scrum-poker-estimates-for-jira?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1227873/teampulse-health-checks-for-jira?tab=overview&hosting=cloud · url

codecentric AG - Marketplace Bug Bounty Program

Bugcrowd · up to $1,500 · 1 new asset

1 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1227136/issue-picker-for-jira?hosting=cloud&tab=overview · url

Creativas

Bugcrowd · up to $1,500 · 5 new assets

5 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1216979/smart-courses-for-confluence-lms?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1218080/smart-tables-for-confluence?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1219677/smart-terms-for-confluence-glossary?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1225000/smart-images-for-confluence?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1234678/smart-terms-for-jira-glossary?hosting=cloud&tab=overview · url

Digital Rose's Marketplace Bug Bounty

Bugcrowd · up to $1,500 · 3 new assets

3 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1221581/esign-electronic-signatures-for-jira?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1224071/esign-electronic-signatures-for-confluence?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1228868/esign-document-management?hosting=cloud&tab=overview · url

Railsware

Bugcrowd · up to $1,500 · 4 new assets

4 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1215277/smart-checklist-for-jira-free?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1216451/smart-checklist-for-jira-enterprise?hosting=cloud · url
- https://marketplace.atlassian.com/apps/1231143/smart-templates-issue-templates-for-jira?hosting=cloud&tab · url
- https://marketplace.atlassian.com/apps/1233681/smart-ai-release-notes-for-jira?tab=overview&hosting=cloud · url

Savignano Software Solutions Marketplace Bug Bounty Program

Bugcrowd · up to $1,500 · 3 new assets

3 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1218251/s-notify-email-encryption-for-jira?hosting=datacenter · url
- https://marketplace.atlassian.com/apps/1218509/s-notify-email-encryption-for-confluence?hosting=datacenter · url
- https://marketplace.atlassian.com/apps/1226720/s-notify-email-encryption-for-bitbucket?hosting=datacenter · url

Vectors Bug Bounty

Bugcrowd · up to $1,500 · 8 new assets

8 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1211800/glossary?hosting=cloud · url
- https://marketplace.atlassian.com/apps/1211855/faq-for-confluence?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1211894/ideation?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1212012/discussion-for-confluence?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1212124/spectrum-formatting-macros?hosting=cloud · url
- https://marketplace.atlassian.com/apps/1217652/content-status-for-confluence?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1235238/morph-ai-powered-content-formatting-for-confluence?tab=overview&hosting=cloud · url
- https://marketplace.atlassian.com/apps/1235579/comment-toolkit-for-jira?hosting=cloud&tab=overview · url

New assets on existing programs

Expedia Group Bug Bounty

HackerOne · 16 new assets · 6 publicly disclosed reports, most often: Code Injection (1), Cross-site Scripting (XSS) - Reflected (1), Cross-site Scripting (XSS) - Stored (1)

*.abritel.fr · wildcard · max severity critical · since 2026-09-10
*.bookabach.co.nz · wildcard · max severity critical · since 2026-09-10
*.ean.com · wildcard · max severity critical · since 2026-09-10
*.expedia-aarp.com · wildcard · max severity critical · since 2026-09-10
*.expedia.com · wildcard · max severity critical · since 2026-09-10
*.expediagroup.com · wildcard · max severity critical · since 2026-09-10
*.expediapartnersolutions.com · wildcard · max severity critical · since 2026-09-10
*.fewo-direkt.de · wildcard · max severity critical · since 2026-09-10
*.hotels.com · wildcard · max severity critical · since 2026-09-10
*.orbitz.com · wildcard · max severity critical · since 2026-09-10
*.stayz.com.au · wildcard · max severity critical · since 2026-09-10
*.tiqets.com · wildcard · max severity critical · since 2026-09-10
com.carrentals · mobile · max severity critical · since 2026-09-10
com.homeaway.android · mobile · max severity critical · since 2026-09-10
506426310 · mobile · max severity critical · since 2026-09-11
642441300 · mobile · max severity critical · since 2026-09-11

eufy Security

HackerOne · 5 new assets

anker-nebula/id1319092174 · mobile · max severity critical · since 2026-09-09
id=com.zhixin.controller · mobile · max severity critical · since 2026-09-09
soundcore/id1331876603 · mobile · max severity critical · since 2026-09-09
2 scope items described in words
- Anker soundcore Work D3200 · device
- Liberty 5 Pro Max D1204 · device

FIS

Bugcrowd · up to $20,000 · 1 new asset

https://www.tdfitloan.com/#!/ · url · since 2026-09-12

Bitso Managed Bug Bounty Engagement

Bugcrowd · up to $15,000 · 1 new asset

https://onchain.cc/ · url · since 2026-09-09

Watsons

Intigriti · up to $8,500 · 1 new asset

id-watsonsbesti.com · url · since 2026-09-11

Web.com Bug Bounty

Bugcrowd · up to $3,000 · 1 new asset

https://app.web.com · url · since 2026-09-12

MoonPay

HackerOne · 1 new asset

*.swaps.xyz · wildcard · max severity critical · since 2026-09-09

Superbet

HackerOne · 1 new asset

*.super.xyz · wildcard · max severity critical · since 2026-09-11

codeclou GmbH

Bugcrowd · up to $1,500 · 2 new assets

2 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1212096/customfield-editor-for-jira?hosting=datacenter&tab=overview · api
- https://marketplace.atlassian.com/apps/1212096/customfield-editor-for-jira?hosting=datacenter&tab=overview · url

Databricks

HackerOne · 1 new asset

1 scope item described in words
- Lakebase-Supported extensions · other

Neon

HackerOne · 1 new asset

1 scope item described in words
- Neon-supported extensions · other

Semrush

HackerOne · 1 new asset · 56 publicly disclosed reports, most often: Improper Access Control - Generic (6), Violation of Secure Design Principles (6), Cross-site Scripting (XSS) - Reflected (6)

1 named under *.semrush.com, already in scope
- www.semrush.com · url

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.