vuln·telMCP serverToolsNew in scopeGuidesField notesGet a key

New in bug bounty scope: week 44, 2026

Oct 26 to Nov 1, 2026 · published 2026-11-03

18 assets newly entered public bug-bounty scope in week 44 of 2026 (Oct 26 to Nov 1, 2026) on 10 programs: 1win, OpenAI, Moneytree KK, Majid Al Futtaim Lifestyle and 6 more. Each asset was checked against its program's own scope history: 60 raw additions that week were assets put back after a removal and 5 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New assets on existing programs

1win

HackerOne · 3 new assets

  • 1win-partners.com · url · max severity critical · since 2026-10-30
  • 1win.io · url · max severity critical · since 2026-10-30
  • forum.1win.io · url · max severity critical · since 2026-10-30

OpenAI

Bugcrowd · up to $30,000 · 1 new asset

  • https://chatgpt.com/dots/ · url · since 2026-10-28

Moneytree KK

Bugcrowd · up to $5,000 · 1 new asset

  • https://mcp-staging.getmoneytree.com/ · api · since 2026-10-28

Majid Al Futtaim Lifestyle

Bugcrowd · up to $3,500 · 1 new asset

  • https://www.pacsun.me/ · url · since 2026-10-28

Cloudflare Public Bug Bounty

HackerOne · 1 new asset · 48 publicly disclosed reports, most often: Improper Authentication - Generic (7), Improper Access Control - Generic (6), Client-Side Enforcement of Server-Side Security (5)

  • https://php-rce.cloudflare.app/ · url · max severity critical · since 2026-10-28

Ubiquiti Inc.

HackerOne · 1 new asset · 98 publicly disclosed reports, most often: Command Injection - Generic (15), Cross-site Scripting (XSS) - Generic (12), Privilege Escalation (9)

  • WiFiman · other · max severity critical · since 2026-10-30

Vercel

HackerOne · 1 new asset · 1 publicly disclosed report, most often: Access Control Check Implemented After Asset is Accessed (1)

  • https://github.com/better-auth/better-auth · source · max severity critical · since 2026-10-31

Visa

HackerOne · 1 new asset

  • http://test.payworks.io/uis/mngr/ · url · max severity critical · since 2026-10-27

Thales Cyber Security Products Bug Bounty

Bugcrowd · up to $2,500 · 1 new asset

  • 1 scope item described in words
    • https://bugcrowd.com/engagements/imperva-mbb · other

StonikByte

Bugcrowd · up to $1,500 · 7 new assets

  • 7 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1157161318/countdown-regional-clock?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1855294554/pivot-tables-charts-heatmaps-for-jira-agile-reporting?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/2113139725/formula-cards-gauge-charts-rag-reports-custom-kpis?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/2194903109/cycle-time-lead-time-time-in-status-charts-for-agile?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/3937617820/team-wallboard-for-agile-scrum-kanban-itsm-dashboards?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/4240011577/work-breakdown-structure-link-hierarchy-dependency-tree?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/89496753/pivot-worklog-reports-timesheets-charts-heatmaps?hosting=cloud&tab=overview · url

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.