New in bug bounty scope: week 40, 2026

Sep 28 to Oct 4, 2026 · published 2026-11-03

98 assets newly entered public bug-bounty scope in week 40 of 2026 (Sep 28 to Oct 4, 2026) on 15 programs: NBA Public Bug Bounty, Vinted Bug Bounty, Walt.io, inDrive and 11 more. Each asset was checked against its program's own scope history: 0 raw additions that week were assets put back after a removal and 112 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Vinted Bug Bounty

Bugcrowd · up to $8,000 · 12 new assets

https://badger.it.vinted.com · url · since 2026-10-01
https://careers.vinted.com · url · since 2026-10-01
https://company.vinted.com · url · since 2026-10-01
https://news.vinted.com · url · since 2026-10-01
https://sandbox.vinted.com · url · since 2026-10-01
https://sandbox.vintedgo.com · url · since 2026-10-01
https://test-escalations.vintedgo.com · url · since 2026-10-01
https://www.vinted.com · url · since 2026-10-01
https://www.vinted.net · url · since 2026-10-01
https://www.vintedgo.com · url · since 2026-10-01
2 listed on apps.apple.com, play.google.com
- https://apps.apple.com/us/app/vinted-pre-loved-marketplace/id632064380 · mobile
- https://play.google.com/store/apps/details?id=fr.vinted · mobile

Walt.io

HackerOne · 10 new assets

http://t.me/wallet · url · max severity critical · since 2026-09-30
http://t.me/walt · url · max severity critical · since 2026-09-30
p2p.walletbot.me · url · max severity critical · since 2026-09-30
pay.wallet.tg · url · max severity high · since 2026-09-30
wallet.tg · url · max severity low · since 2026-09-30
walletbot.me · url · max severity critical · since 2026-09-30
wallettg.com · url · max severity critical · since 2026-09-30
wallettg.net · url · max severity critical · since 2026-09-30
walt.io · url · max severity low · since 2026-09-30
1 scope item described in words
- Crypto infrastructure for cold and hot wallets · other

Omarchy

HackerOne · 1 new asset

https://github.com/omacom/omarchy · source · max severity critical · since 2026-10-02

AI | Apps+ Marketplace Bug Bounty Program

Bugcrowd · up to $1,500 · 24 new assets

24 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1227541/ai-badges-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227543/ai-grammar-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227544/ai-summary-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227545/ai-sentiment-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227546/ai-glossary-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227547/ai-tables-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227548/ai-polls-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227549/ai-tooltips-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227550/ai-tags-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227551/ai-tabs-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227552/ai-latex-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227553/ai-headings-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227554/ai-forms-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227555/ai-copywriter-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227556/ai-code-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227557/ai-labels-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227558/ai-macros-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227559/ai-checklists-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227560/ai-buttons-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1227561/ai-images-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1229018/ai-photos-for-confluence?tab=overview · url
- https://marketplace.atlassian.com/apps/1232262/ai-support-for-jira?hosting=cloud · url
- https://marketplace.atlassian.com/apps/1235733/ai-autofill-for-jira?hosting=cloud · url
- https://marketplace.atlassian.com/apps/1237726/ai-charts-for-confluence?hosting=cloud · url

Bloompeak's Bug Bounty

Bugcrowd · up to $1,500 · 17 new assets

17 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1221826/status-time-reports-time-in-status?hosting=datacenter&tab=overview · url
- https://marketplace.atlassian.com/apps/1221826/status-time?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1222051/status-time-free?hosting=datacenter&tab=overview · url
- https://marketplace.atlassian.com/apps/1222051/status-time-reports-free-time-in-status?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1222833/restore-deleted-issues?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1223002/track-deleted-issues?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1223088/project-roles-groups-and-users?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1224410/manage-users-for-jira-cloud?hosting=cloud · url
- https://marketplace.atlassian.com/apps/1224572/issue-translator?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1226140/issue-translator-free?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1226236/easy-reports-custom-charts-for-jira-dashboard-confluence?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1226236/easy-reports-custom-charts-for-jira-dashboard-confluence?hosting=datacenter&tab=overview · url
- https://marketplace.atlassian.com/apps/1226734/easy-reports-free-custom-charts-for-jira-dashboard?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1226734/easy-reports-free-custom-charts-for-jira-dashboard?hosting=datacenter&tab=overview · url
- https://marketplace.atlassian.com/apps/1231321/sum-up-reports-for-jira?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1231321/sum-up-reports-for-jira?hosting=datacenter&tab=overview · url
- https://marketplace.atlassian.com/apps/2529437344/sprint-capacity-planner-for-jira?hosting=cloud&tab=overview · url

Meetical

Bugcrowd · up to $1,500 · 4 new assets

2 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1222405/meetical-for-confluence-cloud · url
- https://marketplace.atlassian.com/apps/1229489/easy-calendar-integration-for-jira-sync-issues-ics-export?hosting=cloud&tab=overview · other
2 scope items described in words
- For reporting purposes only. Use staging environment listed in brief. · url
- For reporting purposes only. Use staging environment listed in brief. · url

New assets on existing programs

NBA Public Bug Bounty

HackerOne · 13 new assets

cleveland-dev.gleague.nba.com · url · max severity critical · since 2026-10-03
cleveland-qa.gleague.nba.com · url · max severity critical · since 2026-10-03
coachellavalley-dev.gleague.nba.com · url · max severity critical · since 2026-10-03
coachellavalley-qa.gleague.nba.com · url · max severity critical · since 2026-10-03
coachellavalley.gleague.nba.com · url · max severity critical · since 2026-10-03
laketown-dev.gleague.nba.com · url · max severity critical · since 2026-10-03
laketown-qa.gleague.nba.com · url · max severity critical · since 2026-10-03
laketown.gleague.nba.com · url · max severity critical · since 2026-10-03
osceola-qa.gleague.nba.com · url · max severity critical · since 2026-10-03
osceola.gleague.nba.com · url · max severity critical · since 2026-10-03
sandiego.gleague.nba.com · url · max severity critical · since 2026-10-03
valley-qa.gleague.nba.com · url · max severity critical · since 2026-10-03
valley.gleague.nba.com · url · max severity critical · since 2026-10-03

MongoDB

HackerOne · 5 new assets

voyageai.com · url · max severity critical · since 2026-10-01
Evergreen · other · max severity critical · since 2026-10-02
3 scope items described in words
- Atlas Infinite · other
- MongoDB Atlas Agent Engine · other
- MongoDB Atlas Agent Engine CLI and First Party Libraries · other

Intergamma

Intigriti · up to EUR 5,500 · 1 new asset

*werkenbij.intergamma.nl · wildcard · max severity Tier 3 · since 2026-10-01

inDrive

HackerOne · 3 new assets · 18 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Reflected (5), Business Logic Errors (3), Information Disclosure (3)

coms.ryadom.kz · url · max severity high · since 2026-10-02
2 named under *.indrive.com, already in scope
- referral-program.indrive.com · url
- www.juntasllegamos.indrive.com · url

Marriott Bug Bounty Program

HackerOne · 1 new asset

hotshoppeservices.com · url · max severity medium · since 2026-09-29

MercadoLibre

HackerOne · 1 new asset · 6 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Stored (2), Code Injection (1), Insecure Direct Object Reference (IDOR) (1)

Wonder · other · max severity critical · since 2026-10-02

Temu

HackerOne · 1 new asset

partner.temu.com · url · max severity critical · since 2026-09-28

Rivian Bug Bounty

Intigriti · up to $5,000 · 1 new asset

1 scope item described in words
- Rivian iOS Application · mobile

StonikByte

Bugcrowd · up to $1,500 · 4 new assets

4 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1752044660/cumulative-flow-diagram-cfd-charts-for-agile-scrum-kanban?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/2077076462/wip-run-wip-aging-charts-for-scrum-kanban-scaled-agile?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/375826955/burndown-burnup-charts-with-forecast-for-agile-teams?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/607387265/velocity-throughput-charts-for-agile-scrum-kanban?hosting=cloud&tab=overview · url

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.