Signal only has one recent CVE, one which lets an attacker keep an audio or video stream open after you hang up. It doesn't disclose e.g. your chats with other users.
It's not great. But I prefer it over the risk of downloading an APK from signal's website that I don't know how to properly verify the integrity of (there's a key listed on the website, but who knows if it's correct?). (I don't use Google play)