Everyone seems to ignore the best unknown CMS out there -
PostNuke - by far the most secure and flexible. No other CMS has a better built in theme engine and permission structure.
But it's not the easiest to learn. I've worked with them all, and PostNuke is still my favourite.