Continuity mistake: The underground car seen in the CCTV video is a different car design from the one where the heroes defuse the bomb (central line design vs another design). The rounded doors is the most visible proof.
Other mistake: At the end of the episode, the evil Shan is texting with (most likely) Moriarity. She is sitting at a desk facing a wall and yet the laser targeting ray appears directly on her forehead, which could only come through a window directly opposite her.
Continuity mistake: In the opening scene when John is going to the refrigerator, a white skull can be seen on the left side of the kitchen table amongst all Sherlock's science equipment. When he closes the refrigerator door again after discovering the severed head, the skull has disappeared. As he's leaving the kitchen, the skull reappears.
Factual error: Sherlock takes pains to explain in detail that he will deliberately corrupt the magnetic code stripe on an access control card he intends to use to enter the elevator to the villain's penthouse, by carrying it next to an operational cell phone. (This is possible due to the low frequency magnetic field from a phone's vibration motor.) But when he actually goes to access the elevator, he simply touches his access card to the reader instead of swiping or inserting the card through a slot, which is how a magnetic stripe reader would operate. The elevator uses an RFID proximity reader, not a magnetic stripe reader - a phone wouldn't corrupt an embedded RFID tag.
Continuity mistake: We see John come into the room and stand next to Mrs. Hudson and put on his coat. After a few shots Mrs. Hudson walks away with the plates and says, "Lovely tune, Sherlock..." As she's walking away we see John isn't wearing his coat, and he puts it on again.
Deliberate mistake: The army major wears a full beard. British Army personnel may not wear beards. (The beard is a nod to the original canon character on which he's based, John Barrymore, who is described in the book multiple times as being a "black-bearded man").
Plot hole: For the supposed code that hacks into UK system, Sherlock deduces that the finger taps are counted as 1s in the binary code and the rest (while Moriarty's fingers are in the air) are taken as 0s. Sherlock can't know the rate at which the rests are counted in the binary code that he thinks Moriarty tapped out. So even if the key code was real, he wouldn't have known what it was.