Vulnerability not being resolved when CPE is not present but CVE is in Local DB

The defect may already be reported! Please search for the defect before creating one.

### Current Behavior:
A specific nuget package RestSharp version 104 is being used in the project. The component is in the DT project list as RestSharp v104. No vulnerabilities are detected. When I do an external search on the web I can find a Vulnerability CVE-2021-27293. This CVE is listed in the vulnerabilites db in DT so it should find it.

### Steps to Reproduce:
Add RestSharp v104 to project
build package
Create Cyclonedx sbom from build
Run DT report.
No vulnerabilites detected

Manually add the specific CPE (- cpe:2.3:a:restsharp:restsharp:104.0.0:*:*:*:*:*:*:*) to the Component in DT. The cve is list as expected.

### Expected Behavior:
Nuget package RestSharp shows up in project components as a CVE vulnerability.

### Environment:

- Dependency-Track Version: v4.3.6
- Distribution: Docker
- BOM Format & Version: Cyclonedx 1.3
- Database Server: Default internal
- Browser: Edge