Where can I find a list of un-patched CVEs for a specific piece of software?

one good starting point for this would be www.secunia.com. You can get a list by product there, of known security issues, and the note on the page unpatched issues. For windows 7 for example, there's this list

You might try the National Vulnerability Database (NVD) advanced search page, however it is quite slow and isn't great for searching for a specific product.

A faster and more direct service is CVE Details which lets you browse CVEs by product.

Finally, you could try downloading machine-readable CVEs and parsing them yourself.