False positive

### Current Behavior

Hello,

What I am experiencing is that the component :

ffmpeg
version : 7:5.1.6-deb12u1 (5.1.6)
is reported as vulnerable (critical),
although the associated CVE :

https://nvd.nist.gov/vuln/detail/CVE-2016-10192

should apparently NOT match this version of ffmpeg : "up to 2.8.9".

It looks like a bug in Dependency Track in this case to correctly interpret "up to version".

### Steps to Reproduce

1.have ffmpeg in your sbom

### Expected Behavior

recent versions of ffmpeg should not be flagged for this CVE

### Dependency-Track Version

4.13.1

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported