Of the free control panels the ones worth using have already been mentioned. Webmin/Virtualmin - these guys are pretty good about fixing security flaws.
VestaCP for the most part is secure (even when you compare it to the big paid panels) - there is a known exploit with its backup system and how it works, though I won't disclose it here. Only really a concern if you're planning on hosting other people on it.
I've spent a decent amount of time with Ajenti and AjentiV. Since it is not really meant to be given out to other people to use it's more for you to use personally that negates a lot of the security concerns you get into with web panels (mainly other people gaining root access). I'm using Ajenti on a couple of projects just to test it, and it's a nice little panel.
With anything I run on servers that do not need external user access I normally only open the port that the specific panel uses to my external IP address only.