Where or how can I find a list of only unpatched security exploits for an out-of-support operating system? I want to be sure I can inform server owners of the actual risks of staying on an obsolete OS. I can get a list of all CVEs, but I have been unable to filter for patch status.
Typically, what I do is run a Vulnerability scan on the machine. That covers more than just the unpatchable exploits and can get into things like lack of support for newer protocols or newer crypto standards.
A scan will show the list of exploits specific to that machine as well as the other weaknesses that it might be subject to.
In addition, a scanner will rank the severity of the risks, which will make it easier to communicate to stakeholders.
I know that you were asking for a database before, but a scanner contains this database, and it filters it for the specific target.
CVE Details states there were 414 vulnerabilities reported with 98 patches. Be advised a service pack may have fixed many vulnerabilities so the numbers are not indicative of Windows 2003 still containing 316 vulnerabilities (414-98). This also could never include zero days, nor third party vulnerabilities (e.g., Adobe, JAVA, etc)