vuln·telMCP serverToolsNew in scopeGuidesField notesGet a key

New in bug bounty scope: week 42, 2026

Oct 12 to Oct 18, 2026 · published 2026-11-03

71 assets newly entered public bug-bounty scope in week 42 of 2026 (Oct 12 to Oct 18, 2026) on 11 programs: Twilio, 1win, Fivetran, Bolt Technology OÜ and 7 more. Each asset was checked against its program's own scope history: 7 raw additions that week were assets put back after a removal and 34 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Amoeboids

Bugcrowd · up to $1,500 · 8 new assets

  • 8 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1212849/upraise-for-employee-success-with-okrs?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1215431/ai-powered-automated-release-notes-for-jira?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1217536/embedder-for-confluence?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1218801/upraise-for-employee-garrison?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1220406/upraise-people-for-jira?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1221519/roadmap-portal-for-jira-service-desk?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1225798/screenjar-screen-recorder-for-jira?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1230896/arn-confluence-helper-app?hosting=cloud&tab=overview · url

Smart Guess ehf. - Marketplace Bug Bounty Program

Bugcrowd · up to $1,500 · 3 new assets

  • 3 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1225496/?hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1234104/smart-guess-free-planning-poker-for-jira?tab=overview&hosting=cloud · url
    • https://marketplace.atlassian.com/apps/4028833452/smart-guess-time-in-status-flow-intelligence-ai-guidance?hosting=cloud&tab=overview · url

Lively Apps GmbH - marketplace Bug Bounty Program

Bugcrowd · up to $1,500 · 5 new assets

  • 5 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1211199/pocketquery-sql-rest-for-confluence?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1213057/lively-blogs-vibrant-news-for-confluence?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1214272/task-reminder-for-confluence?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1224660/link-management-for-confluence?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1224662/usage-statistics-for-confluence?hosting=cloud&tab=overview · url

New assets on existing programs

Twilio

HackerOne · 40 new assets

  • 1console.twilio.com · url · max severity critical · since 2026-10-14
  • accounts.twilio.com · api · max severity critical · since 2026-10-14
  • api.authy.com · api · max severity critical · since 2026-10-14
  • bulkexports.twilio.com · api · max severity critical · since 2026-10-14
  • client.dev · url · max severity critical · since 2026-10-14
  • com.authy · mobile · max severity critical · since 2026-10-14
  • com.authy.authy · mobile · max severity critical · since 2026-10-14
  • connectedapps.dev · url · max severity critical · since 2026-10-14
  • conversations.twilio.com · api · max severity critical · since 2026-10-14
  • github.com/segmentio · source · max severity critical · since 2026-10-14
  • github.com/sendgrid · source · max severity critical · since 2026-10-14
  • github.com/stytchauth/is-agent · source · max severity critical · since 2026-10-14
  • github.com/stytchauth/samlshield · source · max severity critical · since 2026-10-14
  • github.com/stytchauth/stytch-android · source · max severity critical · since 2026-10-14
  • github.com/stytchauth/stytch-browser · source · max severity critical · since 2026-10-14
  • github.com/stytchauth/stytch-dotnet · source · max severity critical · since 2026-10-14
  • github.com/stytchauth/stytch-go · source · max severity critical · since 2026-10-14
  • github.com/stytchauth/stytch-ios · source · max severity critical · since 2026-10-14
  • github.com/stytchauth/stytch-ios-dfp · source · max severity critical · since 2026-10-14
  • github.com/stytchauth/stytch-java · source · max severity critical · since 2026-10-14
  • github.com/stytchauth/stytch-management-go · source · max severity critical · since 2026-10-14
  • github.com/stytchauth/stytch-management-python · source · max severity critical · since 2026-10-14
  • github.com/stytchauth/stytch-mobile · source · max severity critical · since 2026-10-14
  • github.com/stytchauth/stytch-node · source · max severity critical · since 2026-10-14
  • github.com/stytchauth/stytch-php · source · max severity critical · since 2026-10-14
  • and 15 more

1win

HackerOne · 5 new assets

  • 1wintoken.com · url · max severity critical · since 2026-10-15
  • 1wtoken.com · url · max severity critical · since 2026-10-15
  • https://solscan.io/account/B2RFzpckwjtHXHMrPMKarg6Cj6xkSdT6mru4gJiJE87L · other · max severity critical · since 2026-10-15
  • https://solscan.io/account/GWvQinGBRa7ZUzhXY23MrLjdsx3KfRGxH8yXURBwrz1R · other · max severity critical · since 2026-10-15
  • https://solscan.io/account/sxzuA7TuRvjVbrXkJUgrYq2hfjVf3RFd8WFaSxt2rYm · other · max severity critical · since 2026-10-15

Fivetran

Bugcrowd · up to $7,500 · 4 new assets

  • https://*.dbt.com · url · since 2026-10-14
  • https://*.dbtlabs.com · url · since 2026-10-14
  • https://*.getdbt.com · url · since 2026-10-14
  • https://it-fivetran.com · other · since 2026-10-14

Bolt Technology OÜ

Bugcrowd · up to $6,500 · 1 new asset

  • https://new-food.bolt.eu · url · since 2026-10-14

Magic Apps Marketplace Bug Bounty

Bugcrowd · up to $1,500 · 1 new asset

  • https://app.magicestimations.com · url · since 2026-10-14

Expedia Group Bug Bounty

HackerOne · 2 new assets · 6 publicly disclosed reports, most often: Code Injection (1), Cross-site Scripting (XSS) - Reflected (1), Cross-site Scripting (XSS) - Stored (1)

  • 2 listed on apps.apple.com, play.google.com
    • https://apps.apple.com/in/app/expedia-group-partner-central/id987675995 · mobile
    • https://play.google.com/store/apps/datasafety?id=com.expediapartnercentral&hl=en · mobile

Notion Labs, Inc.

HackerOne · 1 new asset

  • 1 scope item described in words
    • Notion MCP · other

PayPal

HackerOne · 1 new asset · 13 publicly disclosed reports, most often: HTTP Request Smuggling (2), Open Redirect (2), Cross-site Scripting (XSS) - Reflected (2)

  • 1 scope item described in words
    • Account restrictions and control bypasses - campaign · other

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.