Regarding the security vulnerability: it might be interesting to mention that following an initative by the architecture council, openHAB now has a Security Policy and participates in the Common Vulnerabilities and Exposures (CVE) program. You can report vulnerabilities to security@openhab.org and they will be discussed privately until a security advisory and CVE are eventually published.
This remote code execution vulnerability (CVE-2020-5242) involving the exec addons is actually pretty nasty so now that it’s out there, all users are strongly advised to upgrade to 2.5.2 whenever possible, even if you don’t use the exec binding or transformation.