Revealing mistake: There is a mistake in the (quite dodgy) CGI when the car tumbles down into the dam in the opening scene. At one point, the camera cuts and we can see the car bouncing downwards through the air, and there's a splash of water from where the car bounced off the wall of the dam. But if you pay attention, the splash of water simply vanishes/fades away about two seconds later. Sure, if it was more of a fine mist, it'd make sense that it'd lose visibility, but these were huge streaks of water that should still be visible for quite a bit longer.
Plot hole: Jezzie has files about Dimitri in her computer and is the one who asks Cross to do the stake-out at the embassy. She knows of Soneji's plan to kidnap the Russian kid, but wants it to fail, since she is more than content with the millions of ransom for Megan. This part does not make sense on any level; she can't know on which day Soneji is attempting the kidnapping, and since she and her accomplice know where he is hiding (or else they wouldn't be able to grab Megan from him when he is away), by all means they should have killed him rather than run the huge risk to let him try to kidnap another kid at the well guarded embassy and have him killed or worse, captured, before they can do their scheme replacing him. For their plan to succeed, Soneji needs to be dead, so he won't mess up for his delusions of grandeur.
Plot hole: Devine is in the hideout. It is late evening/night. Nothing in the timeline here makes sense. For starters, the newscast says that "over a week ago" the manhunt for Soneji started. Cross gets on the case the first day, on day 2 they find Mercusio's home, day 3 the failed embassy run and Megan is taken away from Soneji (but nobody knows), day 4 is the jewelry heist, leaving Soneji to be killed the same day or after (the movie messes up on that account but seems to want it to happen the same day, I'd give it another day, making it 5). Moreover, it says that Soneji was killed late in the afternoon the day before; it means that Jezzie waited more than a whole day to go to him, and Devine's comment about the kid being so doped up she didn't realise she is not on the boat makes no sense when it implies she'd have to sleep for 2 days straight instead of one. (01:23:00)
Continuity mistake: After receiving instructions from Mercusio (when Cross is told to go to the Watergate), agent Ollie McArthur says "okay people, let's move." He says that across two shots; in the first, Monica Potter is distinctly shifting her eyes from looking in front of her to looking to her right, but in the second she is looking straight again, making the lack of continuity quite obvious over such a small detail. (01:03:50)
Continuity mistake: Jezzie's computer that she used for all her operations has the screen seemingly turned on, always of a bright blue even before Cross actually switches it on. When he looks at the password screen with just 'Administrator' as username, the screen is black, like it is not in any other part of the scene. (01:27:40)
Plot hole: There is a massive problem in the timeline of the movie, starting when the 'running game' is set. It is dawn when the kidnapper contacts the family and the police. He says, that he will call back in 9 hours, and even says "4 PM sharp." The events unfold, and Cross is on the metro train during rush hour, firing his gun. But at the press conference that follows, agent Ollie McArthur declines to comment on the "incident on the MTA train this morning." (01:03:05 - 01:10:00)
Plot hole: In her plot convenient computer content, Cross finds the address of the house for lease Jezzie has. The house is located in Lovettsville, Virginia. That means it's over one hour away from the apartment in Washington. If we take at face value what happens in the movie, with Cross breaking into the house once Jezzie has killed Devine, then it's impossible he made it in time to catch her and save Megan. One wonders what took Cross so long anyway to get to the house considering he visited the school that tipped him off about Jezzie when students were still around, and why he does not warn the authorities (which is kinda hilarious since what tips Megan off about Jezzie, is that she came alone, exactly what the hero does!). The timer on the computer screen when Cross finds out is 00:00:00, which is a bit unlikely and not much help. (01:29:00)
Plot hole: Cross says that the best strategy to keep the kid alive is to pamper Soneji, stroke his ego and make him a living legend as he wants to be. What Soneji did though, was guide them to his real identity and name, since Soneji is just a front he used to be employed at Cathedral School, and in the first conversation with Cross he said about the Soneji name "That'll do for now." It's obvious to anyone then that he wants his real name and self to emerge from obscurity and drop the alias, and if Cross really wanted to please the kidnapper, he should have used his real name, Jonathan Mercusio. Despite these clear elements, that name is never used or referenced in the movie again.
Plot hole: From a logistic and tactical point of view, the whole police/FBI operation revolving around the diamonds does not make any sense. The agents are supposedly spread around and in great numbers, but everyone is simply chasing him, while Cross is speaking freely through the radio and shares the addresses and instructions so they should be -ahead - of him, they know where he is going! Although, during the action, Cross tends to speaks directly with Jezzie all the time, as if all the other dozens of agents did not exist. Jezzie's presence itself is completely illogical, too, since Soneji ordered that nobody would follow Cross or he will kill the girl, and Jezzie is the one agent that he knows (she's been the kid's bodyguard for 2 years!) and is sure to recognize. She should be nowhere near the chase, but nobody objects at all.