A computer-implemented method for detecting unknown vulnerabilities in computing processes, at least a portion of the method being performed by a server comprising at least one processor, the method comprising: monitoring, at the server, a computing environment that facilitates execution of a computing process by logging telemetry data related to the computing process while the computing process is running within the computing environment; determining, at the server, that the computing process crashed while running within the computing environment; wherein logging the telemetry data comprises at least one of: creating a crash dump; recording a call stack of the computing environment; tracing at least one API called by the computing process; identifying which call stack of the computing environment was involved in the crash of the computing process; in response to determining that the computing process crashed, searching the telemetry data at the server for evidence of any vulnerabilities that potentially led the computing process to crash while running within the computing environment; identifying, while searching the telemetry data, evidence of at least one vulnerability of the computing process that is not yet known to exist within the computing process by identifying a pattern that indicates and/or suggests that the call stack that included an exception handler of computing process overflowed and the exception handler was overwritten, determining that the identified vulnerability is not yet known to exist within the computing process, by: querying a database that includes a running list of vulnerabilities that are known to currently affect or to have previously affected a vast number of computing processes; determining, based at least in part on the query, that the database does not identify the computing process as having the vulnerability; in response to identifying the evidence of the computing process's vulnerability and determining that the identified vulnerability is not yet known to exist within the computing process, performing at least one security action to hinder any potentially malicious exploitation of the computing process's vulnerability. monitoring, at the server, a computing environment that facilitates execution of a computing process by logging telemetry data related to the computing process while the computing process is running within the computing environment; determining, at the server, that the computing process crashed while running within the computing environment; wherein logging the telemetry data comprises at least one of: creating a crash dump; recording a call stack of the computing environment; tracing at least one API called by the computing process; identifying which call stack of the computing environment was involved in the crash of the computing process; creating a crash dump; recording a call stack of the computing environment; tracing at least one API called by the computing process; identifying which call stack of the computing environment was involved in the crash of the computing process; in response to determining that the computing process crashed, searching the telemetry data at the server for evidence of any vulnerabilities that potentially led the computing process to crash while running within the computing environment; identifying, while searching the telemetry data, evidence of at least one vulnerability of the computing process that is not yet known to exist within the computing process by identifying a pattern that indicates and/or suggests that the call stack that included an exception handler of computing process overflowed and the exception handler was overwritten, determining that the identified vulnerability is not yet known to exist within the computing process, by: querying a database that includes a running list of vulnerabilities that are known to currently affect or to have previously affected a vast number of computing processes; determining, based at least in part on the query, that the database does not identify the computing process as having the vulnerability; querying a database that includes a running list of vulnerabilities that are known to currently affect or to have previously affected a vast number of computing processes; determining, based at least in part on the query, that the database does not identify the computing process as having the vulnerability; in response to identifying the evidence of the computing process's vulnerability and determining that the identified vulnerability is not yet known to exist within the computing process, performing at least one security action to hinder any potentially malicious exploitation of the computing process's vulnerability.