MS12-063 was an IE exploit on XP, Vista, and 7. Though not specifically an OS vulnerability, it's a pretty big one. MS08-067 was certainly the goto XP exploit

MS12-063 was an IE exploit on XP, Vista, and 7. Though not specifically an OS vulnerability, it's a pretty big one. MS08-067 was certainly the goto XP exploit for the longest time. I still find computers vulnerable to that nearly 5 years later. Disclaimer: I only dabble in security and am basically limited to metasploit for my knowledge, so corrections are welcome.