The Vendor is the company, or group, that produces and markets your CMS. 

In relation to open source projects, the term "vendor" is a little inappropriate, since you don't have to pay for the product itself, and the task of the "vendor" is sell you the product, without expecting you to pay for it.

You may, however, need and/or want to pay for services associated with the product, such as

• support,
• installation
• development
• upgrading

though not necessarily directly to the vendor.

TYPO3, for example, welcomes donations, but maintains a strongly open source stance, and does not itself offer services other than through its web site. Other vendors produce hybrid products, where there is a highly functional community open source version of their software, and an even better specified commercial version.

Concerns are frequently expressed about the quality and stability of both the vendors of open source software, and the products themselves.

The best projects, such as TYPO3, are developed using a system which relates closely to the principle of resilience underlying the internet itself. Parts can fail, but the whole system tends to survive. Virtually all of the developers use the product for their own paid work, and therefore have an interest in having it work to a high standard.

In extremis you are not dependent on the survival of the vendor for the capacity to modify and develop the code, since it is open source.

In addition to the core development team, which is very active, there is a large community of developers and a large support community.