The complete GPIO bank 0 (BCM0-BCM27) is exposed on the 40 pin header, so in theory you have 28 digital outputs.
Note that BCM0 & BCM1 will be pulsed early during the boot process while the VPU firmware looks for an I2C HAT eeprom on those lines (but afaicr it may be possible to disable this in config.txt).
BCM 2 & BCM3 have strong hardware pulls ~2k2 up to 3V3 (I2C option there). On boot, all of BCM0-8 have weak internal pulls up, while BCM9-27 have weak internal pulls down.
If you need hardware PWM on more than a couple of pins then you should look to use Joan's
pigpio.
Edit: there's a linux serial console defaulting on BCM14/15, but those too can be claimed for your own use.