First of all: there is no such thing as an hidden IP address. If people connect to your setup then they'll need an IP address to do so. That's simply how the Net works. You can "hide" it by using a domain name but seriously: you're not hiding anything at all. Looking up the IP address that is assigned to a domain name takes 1 simple command which anyone familiar with this will know ('nslookup' for starters).

As to the risks: this heavily depends on your setup. How are you connected to the Internet? Are you using a router? If so then you may need to set up forwarding (as mentioned below) and this also means that the router will be at most risk. When people try to connect to your IP address they'll contact your router first which will then decide if the request should be ignored or forwarded to your machine.

But this changes if your PC somehow gets assigned with a public IP address. This setup is somewhat rare but some providers use it. In that scenario you connect your PC to a router which forwards all the stuff it gets from the provider. In more technical terms the router mostly performs a bridge operation. This means that all the incoming requests get forwarded to your PC one on one. So in order to keep bad stuff out you'd better use a firewall. But as mentioned: this is a rather rare setup.

Speaking of firewalls: assuming you use a router then, although advisable, you don't have to worry too much about a firewall on your PC. The reason for that is because your router will most likely be the main gateway which can be used to keep the 'bad guys' out.

Risks...

There are plenty. First you really need to check your router and check if its firmware is fully up to date. That's because of 2 reasons: a recent firmware will most likely also perform better, but most of all it will hopefully have less possible security flaws.

Next: you definitely want to make sure that whatever OS you run is also fully up to date where security patches are concerned.

And finally Minecraft itself: be sure to use the latest Java runtime. I'd stick with JRE8 myself because it doesn't differ too much and Minecraft was developed with Java version 8 in mind in the first place. But just make sure you're using the latest version, you can download this from Oracle.

Possible risks you're taking:

• DoS or DDoS; for someone who knows how this works it's decently easy to gain access to a 'botnet' which can be abused to sent tons of garbage data your way, effectively kicking you off the Internet. Most ISP's may have solutions for this but it heavily depends on your ISP (and optionally your subscription).
  
• Hackers; you can never rule this out. This is why you should ensure that your router uses the latest firmware possible, and that you also made sure to use sane security settings (for example: you definitely don't want to enable remote administration options or something like that).
  
• In-game cheaters / griefers: dealing with a server means dealing with possible cheaters. Even though Minecraft provides plenty of options to get rid of them there's always the issue of the previous points. A weirdo connects to your server, cheats, you ban him and they get angry and retaliate with a DDoS attack. It doesn't happen too often, but it is a risk you need to keep in mind.
  

My suggestion: limit this to friends only, or at best people who you can somewhat 'trust' and meet up front. For example by using this forum to see what people are like (check their profiles) before you might be tempted to invite them to your server (just be careful with the invitation part; not everyone enjoys getting invited, some could even consider that spam).

Always helps to port forward your IPv4 also, on top of all the other great advice here

[deleted]

If you get many players, it may start to get Lag (server, and probably PC). And if they find out you IP, they can ddos you. Thats all.