Yes, aside from transaction parameters and call messages there are also block headers and potentially, very occasionally, protocol changes, usually by hard forks.
Some information from block headers can be read directly by the contract with variables like
block.timestamp. You can also get the
block.blockhash, which by extension can provide proof of any other data in the block. Data you see here can trusted by contracts to the extent that the protocol is able to enforce them. This can be quite complex - for example see Can a contract safely rely on block.timestamp?
Protocol changes can alter data in storage or the meaning of function calls. They are trusted to the extent that if you didn't think a particular chain using particular software was legitimate then you wouldn't care what result the contract got first place.