bug: inconsistent CVE findings when using SBOM generated for the same software as input file #5419

Description

I did a number of tests to compare the CVE findings in the following two cases:

1. run cve-bin-tool against the software package directly
2. run cve-bin-tool against the SBOM file generated using cve-bin-tool against the same software package

I found discrepancies in the number of CVEs found using the above two methods. Any explanations on such discrepancies?

Thanks