CVE-2022-4696 is listed in the tracker[0] as affecting both linux and
linux-5.10 source packages. The data debsecan creates out of that only
associates it to linux-5.10, though. This prevents that CVE from being
reported on a bullseye system with a vulnerable (< 5.10.162-1) kernel:

  root# dpkg -l *linux-image* | grep ii
  ii  linux-image-5.10.0-19-amd64-unsigned 5.10.149-2   amd64        Linux 5.10 for 64-bit PCs
  root# debsecan | grep CVE-2022-4696
  root#

Tinkering a bit with the debsecan source code, we can see that
CVE-2022-4696 is internally referenced with id 35011, for which the
corresponding package line yields a reference tied only to linux-5.10:

  root# grep 35011 /tmp/debsecan-data-20230724.txt
  CVE-2022-4696 linux-5.10,35011,S   ,,5.10.162-1~deb10u1 5.10.178-3~deb10u1 5.10.179-1~deb10u1

Comparing with for instance CVE-2023-0615, which is linked in the
tracker[1] only to the linux source package, and assigned the internal
id 35182, we can verify that debsecan properly reports it:

  root# grep 35182 /tmp/data
  linux,35182,S   ,6.1.4-1,4.19.282-1 5.10.158-1 5.10.158-2 5.10.162-1 5.10.178-1 5.10.178-3 5.10.179-1 5.10.179-2
  root# debsecan | grep CVE-2023-0615
  CVE-2023-0615 linux-image-5.10.0-19-amd64-unsigned

Cheers,