Components get marked as vulnerable while they do not match the CPE

### Current Behavior

Hello, we are running the latest version (v4.12.3). We see behavior that sometimes, vulnerabilities still show up, even though the component is currently at a higher version than reported in the CPE.

For example, we have `tensorflow` at version `2.18.0` (`pkg:pypi/tensorflow@2.18.0`), but vulnerability `CVE-2021-35958` still shows up, but the CPE of that vulnerability is `cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:* (<=2.5.0)`.

### Steps to Reproduce

1. Create a new project (Application)
2. Add a component and provide the purl as given above
3. Check for vulnerabilities and it shows this dependency vulnerable in the component

### Expected Behavior

Since 2.18.0 is newer than 2.5.0, it should not be marked as vulnerable.

### Dependency-Track Version

4.12.3

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

16.1

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported