I am thinking about installing Tor on my server (running CentOS) but I read it has some vulnerabilities that could be exploited remotely.
Could someone tell me how to configure it for maximum security? and how to make it never work as relay and accept local connections only (like from php scripts using curl).
Even if there are no known vulnerabilities in a piece of software that doesn't mean there are no vulnerabilities in that piece of software. There's no magic answer to the dilemma, treasmix, if you want tor (or any other software) on your server then you have to balance the strength of the risk vs. the strength of your need.
If you look at the release notes / security history of a product and a certain type of vulnerability crops up over and over again then this might be an indicator that the app is a higher risk in certain areas and that the coders won't (or can't) re-write the code to make exploiting it more difficult. But even the absence of a poor security history doesn't mean there is no risk. Sooner or later it comes down to subscribing to their security mailing list/rss feed/twatter feed and hoping for the best.
Here's a link to the tor documentation - it will answer all your questions.
do you know if there is any vulnerability in the latest release i should be aware of?
Sorry, perhaps I was wrong - looks like you would need to browse around a bit at torproject.org to find the tor bug tracker and wiki.
Short of monitoring hundreds of security-related sites, the tor project's own bug tracker will be the best place to see known bugs (though monitoring a site like linuxsecurity.com's RSS feeds can't hurt).
You would be wise to simply assume that it is vulnerable, or will be vulnerable. Run it in the most restrictive container available to you.
In order:
