False negative results and misalignment with the NVD Databases regarding severity

### Current Behavior

Hello.

I've noticed that although in the SBOM file that we uploaded in the DT there is a vulnerable version of a component, the DT does not assign it the vulnerability. Not only that but the vulnerability exists as entry in the vulnerabilities but is listed as `unassigned` severity.

More specificaly:

Vulnerable component in the SBOM: icu-libs@76.1-r0
Vulnerability: [CVE-2025-5222](https://nvd.nist.gov/vuln/detail/CVE-2025-5222) Is listed but with Unassigned severity while it is classified as High.
DT results: Zero vulnerabilities.

If I scan the same SBOM with grype for example, it shows it.

### Steps to Reproduce

1.Upload the attached SBOM file
2.Scan for vulnerabilities

[601df973-aa4b-40b6-9dc2-659f9b222320-inventory.cdx.json](https://github.com/user-attachments/files/22646926/601df973-aa4b-40b6-9dc2-659f9b222320-inventory.cdx.json)

### Expected Behavior

To show up more than 0 vulnerabilities

### Dependency-Track Version

4.13.2

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

15.13

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported