In the spirit of TIMTOWTDI, you can probably use this as selector for the individual nodes:

'advisories/cve[1]'
[download]

for the first, and

'advisories/cve[2]'
[download]

for the second.

I am guessing that for extracting the text, the XPath processor simply concatenates everything it finds..