Follow
Drupal Security Bug is to do with Rest API
Update now available
https://www.drupal.org/node/3034490
Also remember to check Drupal 7 modules as thats not a core update, but modules that have moved into core.
Link! Link! had to be that module that needs the update for D7