Even if there are no known vulnerabilities in a piece of software that doesn't mean there are no vulnerabilities in that piece of software. There's no magic answer to the dilemma, treasmix, if you want tor (or any other software) on your server then you have to balance the strength of the risk vs. the strength of your need.
If you look at the release notes / security history of a product and a certain type of vulnerability crops up over and over again then this might be an indicator that the app is a higher risk in certain areas and that the coders won't (or can't) re-write the code to make exploiting it more difficult. But even the absence of a poor security history doesn't mean there is no risk. Sooner or later it comes down to subscribing to their security mailing list/rss feed/twatter feed and hoping for the best.