s/findvalue/findnodes/. It's also very silly to do the search twice.

if ( $xc->findnodes( 'advisories/cve', $vuln )) {        
    for ( $xc->findvalue( 'advisories/cve', $vuln )) {
        push ( @cve_records, $_ );
    }
}
[download]

should be

for my $cve_node ($xc->findnodes('advisories/cve', $vuln)) {
    push @cve_records, $cve_node->textContent();
}
[download]

---

By the way,

$fnd_vuln_id = $_->findvalue('./@id');
[download]

should be

my $fnd_vuln_id = $_->findvalue('./@id');
[download]

and it can be simplified to

my $fnd_vuln_id = $_->findvalue('@id');
[download]

and even to

my $fnd_vuln_id = $_->getAttribute('id');
[download]

---

By the way, it would probably make more sense to load the nodes /audit/vulnerabilities/vuln into a hash (keyed by the id attribute) before the loop instead of repeatedly searching the tree inside the loop.

Update: Added notes.