Find out unfixed exploits count based on application version

Secunia has an application /OS / hardware appliance vulnerability database which has the info you are looking for.

IE6 Report page for example.

alt text http://secunia.com/advisories/graph/?type=sol&period=all&prod=11

and Java JRE 1.2.x

alt text http://secunia.com/advisories/graph/?type=sol&period=all&prod=785

I think something like the Nessus vulnerability list is probably going to be your best bet, but I'm not sure how to do that without running Nessus itself. cve.mitre.org has the most comprehensive list of vulnerabilities, but I've never looked for a list organised by software product, so I don't know if there's anything like that there.