Added CVE reference to changelog
Added XXE protection to HTML Reader