New in bug bounty scope: week 41, 2026

Oct 5 to Oct 11, 2026 · published 2026-11-03

84 assets newly entered public bug-bounty scope in week 41 of 2026 (Oct 5 to Oct 11, 2026) on 10 programs: inDrive, NBA Public Bug Bounty, Cvent Bug Bounty, ZECIBLE PUBLIC BUG BOUNTY PROGRAM and 6 more. Each asset was checked against its program's own scope history: 1 raw additions that week were assets put back after a removal and 4 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Cvent Bug Bounty

Bugcrowd · up to $3,000 · 14 new assets

Cvent CSN Destination Guide -> https://www.cvent.com/meeting-event-planning/* · url · since 2026-10-10
Cvent CSN Suppliers -> https://app.cvent.com/Subscribers/RFP/* · url · since 2026-10-10
Cvent CSN-RFP -> https://app.cvent.com/Subscribers/Suppliers/* · url · since 2026-10-10
Cvent Core-Admin -> https://app.cvent.com/Subscribers/Admin/* · url · since 2026-10-10
Cvent Core-Appointments -> https://app.cvent.com/Subscribers/Appointments/* · url · since 2026-10-10
Cvent Core-Attendee Hub Web -> https://web.cvent.com/hub/events/* · url · since 2026-10-10
Cvent Core-Flex -> https://web.cvent.com/event/* · url · since 2026-10-10
Cvent Core-Paygo -> https://www.cvent.com/en/event-management-software/free-trial · url · since 2026-10-10
Cvent Core-Planner -> https://app.cvent.com/Subscribers/Events2/* & https://events.app.cvent.com/events/* · url · since 2026-10-10
Cvent Core-Survey -> https://app.cvent.com/Subscribers/Inquisium/* · url · since 2026-10-10
4 listed on apps.apple.com, play.google.com
- Cvent Core-Attendee Hub Mobile iOS -> https://apps.apple.com/us/app/cvent-events/id1491335576 · mobile
- Cvent Core-Attendee Hub Mobile Android -> https://play.google.com/store/apps/details?id=com.cvent.mobile.eventapp · mobile
- Cvent OSS-OnArrival Mobile Android -> https://play.google.com/store/apps/details?id=com.cvent.onarrival · mobile
- Cvent OSS-OnArrival Mobile iOS -> https://apps.apple.com/us/app/onarrival/id680778967 · mobile

Almarise Marketplace Managed Bug Bounty Engagement

Bugcrowd · up to $1,500 · 1 new asset

1 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1225059/apptime-free-time-tracking-planning-team-mangement?hosting=cloud&tab=overview · url

Avisi Marketplace Bug Bounty Program

Bugcrowd · up to $1,500 · 8 new assets

8 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1211141/xsd-viewer?hosting=cloud · url
- https://marketplace.atlassian.com/apps/1211675/git-for-confluence?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1212035/edit-custom-field-values?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1213313/atlas-crm-customers-and-sales-in-jira?hosting=cloud · url
- https://marketplace.atlassian.com/apps/1216060/atlas-crm-customers-in-confluence?hosting=cloud · url
- https://marketplace.atlassian.com/apps/1222136/topdesk-jira-integration?hosting=cloud · url
- https://marketplace.atlassian.com/apps/1229840/visualizer-for-confluence-markdown-plantuml-mermaid-erd?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/792203801/frank-not-your-regular-hr-solution?hosting=cloud&tab=overview · url

Decadis AG

Bugcrowd · up to $1,500 · 3 new assets

3 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1211625/sumup-for-jira?hosting=cloud&tab=overview · other
- https://marketplace.atlassian.com/apps/1227484/advanced-formula-fields-calculated-custom-fields-for-jira?hosting=cloud&tab=overview · other
- https://marketplace.atlassian.com/apps/29496/jira-workflow-toolbox?hosting=cloud&tab=overview · other

Excentia Bug Bounty

Bugcrowd · up to $1,500 · 1 new asset

1 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1217471/sonarqube-connector-for-jira?hosting=cloud&tab=overview · url

New assets on existing programs

NBA Public Bug Bounty

HackerOne · 19 new assets

comets-dev.wnba.com · url · max severity critical · since 2026-10-06
comets-qa.wnba.com · url · max severity critical · since 2026-10-06
comets-uat.wnba.com · url · max severity critical · since 2026-10-06
comets.wnba.com · url · max severity critical · since 2026-10-06
cweb-ott-uat.nba.com · url · max severity critical · since 2026-10-06
cweb-ott-wnba-dev.nba.com · url · max severity critical · since 2026-10-06
cweb-ott-wnba-qa.nba.com · url · max severity critical · since 2026-10-06
cweb-ott-wnba.nba.com · url · max severity critical · since 2026-10-06
dev.stats.wnba.com · url · max severity critical · since 2026-10-06
identity.wnba.com · url · max severity critical · since 2026-10-06
lineemup-dev.wnba.com · url · max severity critical · since 2026-10-06
lineemup.wnba.com · url · max severity critical · since 2026-10-06
login-dev.wnba.com · url · max severity critical · since 2026-10-06
login-qa.wnba.com · url · max severity critical · since 2026-10-06
login-uat.wnba.com · url · max severity critical · since 2026-10-06
login.wnba.com · url · max severity critical · since 2026-10-06
pata.wnba.com · url · max severity critical · since 2026-10-06
playbook.wnba.com · url · max severity critical · since 2026-10-06
tue.wnba.com · url · max severity critical · since 2026-10-06

ZECIBLE PUBLIC BUG BOUNTY PROGRAM

YesWeHack · up to $ 2,000 · 2 new assets

ywh.static.zcb.fr · url · since 2026-10-07
ywh.verify.zecible.fr · api · since 2026-10-07

Auth0 by Okta

Bugcrowd · up to $50,000 · 1 new asset

webtask.run · url · since 2026-10-06

Visa

HackerOne · 1 new asset

https://ebctest.cybersource.com/varm · url · max severity critical · since 2026-10-10

inDrive

HackerOne · 34 new assets · 18 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Reflected (5), Business Logic Errors (3), Information Disclosure (3)

34 named under *.indriverapp.com, already in scope
- ps-gw-cf.euce1.indriverapp.com · url
- ra-cf.euce1.indriverapp.com · url
- ra-gw-cf.euce1.indriverapp.com · url
- ra-gw-scf.euce1.indriverapp.com · url
- rc-cf.africa.afso1.aws.indriverapp.com · url
- rc-gw-scf.sa.apse1.aws.indriverapp.com · url
- rp-gw-scf.sa.apse1.aws.indriverapp.com · url
- rs-gw-cf.africa.afso1.aws.indriverapp.com · url
- rs-gw-scf.sa.apse1.aws.indriverapp.com · url
- sc-cf.euce1.indriverapp.com · url
- sc-gw-cf.euce1.indriverapp.com · url
- sc-gw-scf.euce1.indriverapp.com · url
- sfc-gw-scf.sa.apse1.aws.indriverapp.com · url
- sn-api-gw-scf.sa.apse1.aws.indriverapp.com · url
- ssn-lb-cf.africa.afso1.aws.indriverapp.com · url
- ssn-lb-scf.sa.apse1.aws.indriverapp.com · url
- sur-gw-cf.euce1.indriverapp.com · url
- sur-gw-scf.euce1.indriverapp.com · url
- tr-cf.euce1.indriverapp.com · url
- tr-gw-cf.euce1.indriverapp.com · url
- tr-gw-scf.euce1.indriverapp.com · url
- tr-scf.euce1.indriverapp.com · url
- trv-cf.euce1.indriverapp.com · url
- txd-cf.cis.euce1.aws.indriverapp.com · url
- txf-cf.cis.euce1.aws.indriverapp.com · url
- txm-gw-cf.cis.euce1.aws.indriverapp.com · url
- vm-cf.mena.meso1.aws.indriverapp.com · url
- vm-gw-scf.sa.apse1.aws.indriverapp.com · url
- was-cf.africa.afso1.aws.indriverapp.com · url
- was-gw-scf.sa.apse1.aws.indriverapp.com · url
- wd1-cf.euce1.indriverapp.com · url
- wd1-gw-cf.euce1.indriverapp.com · url
- wlr-cf.euce1.indriverapp.com · url
- wlr-scf.euce1.indriverapp.com · url

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.