I Dont know if Tomato publishes CVEs. But you could check the release notes for OpenWrt for CVEs over the last couple of years.

I would trust OpenWrt more, especially their continued support for old devices, one accesspoint of mine is 11 years old, supported in the 2022 release and still going strong (128MB RAM, 32MB flash)

FreshTomato I think uses old kernel versions (2.6.xx) where security fixes are not backported. OpenWRT uses modern kernels (5.10) and mainline or external open source drivers but doesn't work on Broadcom devices.

Haven't used it myself, but I'm more keen to trust open source code & communities than vendors.